Connect Callback

Complete the OAuth handoff the provider redirects to: verify the sealed state, exchange the code for the broker-owned account, and land the grant. The grant a turn's connect_account began lands here. State-verified, not bearer-authenticated — the browser carries only the state the connect tool sealed with the speaking member, agent, and conversation.