Exchanges the one-time code from the OAuth success redirect (?code=...) for a session. The code is single-use and expires in ~60s. Returns the same shape as login. Replaces returning tokens directly in the OAuth redirect URL.

curl -X POST "http://localhost:8000/api/auth/oauth/exchange" \
  -H "Content-Type: application/json" \
  -d '{
  "code": "9f8c1b2e4a6d7c3f…"
}'

{
  "message": "You are logged-in successfully",
  "data": {
    "user": {
      "id": "CRa7Bk9x2Q",
      "fullName": null,
      "email": "example@mail.com",
      "role": "CONTENT_CREATOR",
      "accountStatus": "VERIFIED",
      "imageUrl": null
    },
    "token": {
      "accessToken": "**********",
      "refreshToken": "**********"
    }
  }
}