Callback

Handle Microsoft OAuth callback.

• Exchanges code for tokens
• Saves (encrypted) tokens under the team
• Populates metadata (createdBy, updatedBy, connectedAt, email)
• Redirects to the UI redirect URL if provided in state; on error appends error=...