External calendar OAuth callback

OAuth callback endpoint for external calendars.

Refer to POST /v3/resource/{id}/externalCalendar to generate the authUrl.

By default, redirects directly to the stored returnUrl, or to the
authenticated portal picker when none is set. With stored
useOnSchedCalendarSelection true, redirects to guest hosted
/calendar-select with a single-use code. Exchange that code at
POST /v3/calendar/selectionSession for a scoped Calendar Selection Token.
Hosted selection returns to returnUrl only after save or skip.
A completed callback with a concrete writable calendar queues a backfill
of upcoming booked appointments. Read-only Google still redirects
successfully and does not queue that backfill. Outlook waits until a
calendar id is selected.