SSO callback: verifies the presented bearer token and returns the login session payload (user, company, theme, white-label). Used by the SPA after an SSO handoff. Returns 400 for an inactive account, and a 200 signup_pending status when email is unverified or signup is incomplete.

Auth

• bearer token. Role: partner (bundle_id=1) or account (bundle_id=3) user (plus one legacy admin). Any other role gets 403.

Rate limit

• No rate limit.

Behaviour

• 200 with status/token/user/company/theme_options/white_label. 400 if the account is inactive. 403 if the user is neither a partner/account user nor the legacy admin.