Vendor OAuth callback relay (public, unauthenticated).

The redirect_uri registered with the GitHub/Linear OAuth apps. Not called directly by API clients -- the vendor's authorization server redirects the user's browser here after consent. Relays the browser onward with the vendor's code/state query parameters preserved so the client application can complete the flow via POST /mcpservers/oauth/complete. Deliberately unauthenticated: the browser arriving here has not sent any VoIPbin credentials.