Finish or hide OpenRouter OAuth linked-account callback

[thinmintdev]

What to build

OpenRouter OAuth callback handling is currently a deliberate 501 scaffold. Finish the linked-account callback flow if OpenRouter account linking is in scope, or hide/remove the route from user-facing flows so users do not encounter a placeholder.

Acceptance criteria

• The OAuth callback route no longer returns a placeholder 501 in normal flows.
• If implemented, callback validation, token storage, and error handling are covered by tests.
• If deferred, UI/docs/API discovery make clear that linked-account OAuth is unavailable.
• Security-sensitive callback behavior is covered by negative tests.

Blocked by

None - can start immediately