Shared OAuth callback handler

Authorization code from OAuth provider

JWT encoded state with provider and redirect URL

Direct ID token (for Google)

Redirect with access token and user info in query params