Initiate a mailbox-connect flow.
agent_id / team_id are captured in the OAuth state so the callback can bind the grant atomically. Both optional — callers can bind later via the binding endpoint — but at most one may be set on a single request (a mailbox binds to either a single agent or a team).
Revision pins (agent_revision_id / team_revision_id) are OPTIONAL: omitting one pins the target's current active revision at bind (pin-at-bind), a non-null value pins that exact revision. Each may only be set alongside its own agent/team id.
Successful Response
Returns the URL the frontend should redirect / popup the user to.