Shared OAuth callback for External MCP Connections

Deployment-wide callback. Organization, member, and connection routing are derived exclusively from signed state.