OAuth happens in workers/api; the dashboard never sees tokens.

Next: connect Instagram →