Receive the OAuth provider's redirect, exchange the code, render HTML.

Has no session auth — that's by design. This endpoint is the public OAuth redirect_uri; the unguessable state parameter is the defense (RFC 6749 §10.12). The endpoint stores the exchanged tokens on the pending OAuth row keyed by state and returns an HTML page that postMessages the opener and closes the tab.

Emits a per-response Content-Security-Policy: script-src 'nonce-…' header whose nonce whitelists exactly the inline postMessage script in the rendered body. The default app-wide CSP is script-src 'self' which would otherwise block the inline script.