OAuth connect callback

Handle the OAuth callback from the IdP.

This endpoint is intentionally unauthenticated — it receives redirects from external IdPs where the user has no session cookie. Security binding is provided by the signed, time-limited state JWT which ties the callback to a specific credential and caller.

Redirects the popup the SPA opened to a public SPA route (/app/oauth/connected) that owns the user-facing "you can close this" experience and self-closes. Two variants, distinguished only by a coarse status query param:

• Success: ?status=ok.
• Failure: ?status=error — no protocol or provider detail is exposed in the redirect URL.

The parent SPA still learns the real outcome by polling GET /credentials/{id} — never from this redirect. The actual cause (missing state, connect failure, provider error, etc.) is recorded via structured logging for operators.