Zendesk OAuth callback (called by Zendesk — do not call directly)

Public endpoint. Zendesk redirects here with ?code=...&state=... The server exchanges the code (against {subdomain}.zendesk.com/oauth/tokens), stores the access token, and redirects to /settings.