Handles the identity-provider callback after SSO login. Exchanges the authorization code (and the single-use state issued at authorize time) for a Wingspan session token. The response is the same V3 Session resource shape returned by the /platform/sessions credential exchanges, plus wasPersonProvisioned, which is true when Just-In-Time provisioning created a new Person on this login.