OAuth callback

Next step is server-side. Exchange this code for tokens from a trusted context, with the client secret resolved from KSM or Key Vault. The secret must never reach this page or any browser. The authorisation code is single-use and short-lived.