Slack Identity Link Callback

Clerk-authenticated completion of the identity-link flow.

Validates the gate + org membership FIRST using a non-destructive peek, and consumes the single-use token (DELETE ... RETURNING) only as the LAST step, once every check has passed. A wrong-org signin (the caller is authenticated, but into a DIFFERENT Every org than the one that installed this Slack workspace) must not burn the token -- the correct user still needs to be able to use it. Consuming first would let one failed/wrong-org attempt permanently strand the real user with an "expired" link.