Github App Callback

Handle GitHub's redirect back from an App installation.

state is the authentication primitive here - no session auth is required (see module docstring). Flow:

1. Look up the state row by state -> error redirect on miss.
2. Check expiry -> error redirect + discard on expired.
3. setup_action == "request": a non-admin org member requested install; GitHub queues it for owner approval with no installation_id to record yet - discard the state and redirect with an info marker, no connection row.
4. Otherwise installation_id must be present.
5. TOS-7262: code must be present and prove that the GitHub user who installed can access installation_id (see module docstring). Any failure records nothing, discards the state and error-redirects.
6. Write the per-caller connection and discard the state.