Auth callback surface

This host handles the magic-link callback at /callback and is not expected to serve user-facing pages. If you landed here from a browser, you took a wrong turn.