Oauth Callback

Complete the authorization code flow and persist the user's grant.

Not authentication-gated — the browser arrives from Databricks with no guaranteed cookie, so the acting user comes from the single-use transaction handle, redeemed before any other parameter is trusted. A cookie that does arrive must agree with it, or one member could start a flow and lure another into completing it onto the starter's grant.