Multi-provider OAuth callbacks must route code exchange by provider from state

In a multi-provider OAuth service, all provider clients shared one state store. Exchanging the callback code with an arbitrary client was incorrect because token endpoints/auth methods differ per provider. The reliable flow was: consume state once, read provider identifier from persisted metadata, then call exchange_code on that provider’s client with the saved redirect_uri and code_verifier.

When OAuth state is shared across multiple providers, consume state first to resolve the initiating provider, then exchange the code with that provider’s OAuth client; do not use an arbitrary client for token exchange.