OAuth · Approve authorization

Approves the pending OAuth authorization from the dashboard consent screen (Passport session endpoint). `auth_token` is the single-use nonce the authorize redirect handed to the dashboard (`GET /oauth/authorize` → 302 to `{front}/oauth/authorize?auth_token=…`). It is bound to the web session: this endpoint needs the dashboard session cookie plus `X-XSRF-TOKEN` — a personal access token never authenticates it. **Responses**: - With `Accept: application/json` (what the SPA sends): **200** `{"redirect": url}` — the client callback carrying `code` and `state`. The SPA navigates there itself, top level, because a cross-origin XHR cannot follow a 302 to the client's origin (`ConvertsAuthorizationRedirectToJson`). - Without it (plain navigation): **302** with the same URL in `Location`. - Expired, unknown or reused `auth_token`: **403** — the nonce is single use, and the SPA renders its own invalid state for this status. Host root, no `/api` prefix.