MCP OAuth callback

Server-hosted OAuth redirect target. The authorization server redirects the user's browser here with ?code & ?state; this completes the matching in-flight flow (validated by the unguessable state) and renders a success/failure page. Reachable from web + mobile, unlike the 127.0.0.1 loopback callback.