Handle social OAuth callbacks entirely in the API (redirect-only flow); drop the front-end callback route — open to migrating off passport #154