Microsoft auth gate
This route uses Microsoft Entra / MSAL browser auth. Register a single-page application in Microsoft Entra and point the redirect URI at /auth/callback.
/auth/callback