Direct-hit fallback for the registered native redirect_uri. In the real
flow this path is never dereferenced by an actual browser redirect — the
upstream provider’s redirect target is always its own
/auth/<provider>/callback (e.g. /auth/google/callback,
/auth/github/callback), which detects a native-flow authorization
request and short-circuits into stashing the code for /native/poll
instead of redirecting here. This handler only answers a stray direct
visit (e.g. a stale bookmark or a misconfigured client), so state is
validated for URL-shape consistency but deliberately not looked up —
there’s nothing to correlate it against.