Handle OAuth callback from Shopify

Flow:

1. Shopify redirects customer here with authorization code and state
2. Validates state parameter to prevent CSRF
3. Exchanges authorization code for access token using PKCE verifier
4. Validates ID token (JWT) from Shopify
5. Stores access token and refresh token securely
6. Redirects customer back to original return URL

Security:

• Validates state parameter matches stored value
• Uses PKCE code verifier to exchange authorization code
• Validates ID token signature and claims
• State expires after 10 minutes

Error Handling:

• If customer denies authorization, redirects with error parameter
• If token exchange fails, redirects with error parameter
• All errors are logged for debugging

Note: This endpoint should not be called directly - it’s invoked by Shopify’s OAuth redirect.