Browser route called by Atlassian only. Backend validates and consumes the one-time state, exchanges the authorization code server-to-server, stores encrypted tokens, discovers accessible Jira sites, then redirects the browser to Requra's project integration screen. It never returns tokens.