Exchange Oauth Code

Exchange an OAuth authorization code for tokens (called by the browser extension). The extension intercepts the localhost:1455/auth/callback redirect, extracts the code + state, and posts them here. We exchange with OpenAI, store the encrypted tokens in provider_oauth_tokens, activate the account, and return {connected: true}.