Cancels a pending SSO signup, clearing the stashed state.

Confirms a pending SSO signup. Creates the account, links the identity, and logs the user in.

Renders the confirmation page shown after a successful SSO callback that would create a brand-new account. We ask the user to confirm before provisioning so they aren't surprised by an account they didn't realise was being created.

Initiates an SSO link flow for an already-authenticated user. The intent, provider and current user are carried in a session-bound state and the user is redirected to the provider's authorize URL. On callback the controller links the resulting identity to the current account rather than logging in.

Once the user has completed the authorization flow from above, they are returned here, and the authorization code is used to log them in.

Given a known provider, redirect them to the authorize url on the provider