Handle the OIDC callback after the user authenticates with the identity provider. Exchanges the authorization code for an ID token, verifies the token signature via JWKS, extracts user info, maps groups to scopes, and optionally provisions the user via JIT.