Handles the OAuth 2.0 authorization callback from configured identity providers (e.g., Azure AD, Okta). This endpoint is called by the OAuth provider after user authentication. It exchanges the authorization code for tokens, extracts user identity and RBAC roles, and creates an authenticated HTTP session. On success, sets session cookie and CSRF token, then redirects to the main application. Requires pre-configured OAuth settings in Orchestrator.