[POST]
summary = "GitHub 授权回调：换取用户信息并签发平台 token"
docstring = "前端收到 GitHub 回跳的 code+state 后调用；校验 state（一次性）、换取用户信息、按绑定关系 find-or-create 账号，签发与内置登录同契约的平台 token。"
auth_required = false
cacheable = false
params = ["code: str", "state: str"]

[POST.response_model]
result = { type = "str", required = true }
token = { type = "str", required = true }
message = { type = "str", required = true }
timestamp = { type = "float", required = false }