Callback page now receives ?success=true and calls POST /api/auth/refresh instead of exchanging code/state via GET /api/auth/callback. Updated search params, MSW handlers, and assertions to match new flow.