Handle OAuth callback from a third-party provider.
Verifies state parameter, exchanges code for tokens, stores encrypted. Uses OAuthCallbackDbConnection (plain transaction) because the callback has no JWT — user identity comes from the signed state parameter.