The right approval screen opens every time

The validated connection stays intact

The browser policy now reads the callback from the same validated request shape used by the OAuth flow. This fixes a handoff mismatch that could replace the permission screen with a generic connection error.