Addin Callback

Static HTML page used as the OAuth redirect target for Office add-ins. The page reads `exchange_token` (or `error`) from the URL on the client side and relays it back to the add-in's taskpane via `Office.context.ui.messageParent`. Falls back to a copy-paste UI when not opened inside an Office dialog. No server-side templating — the token never touches the response body so there is no template-injection risk; the page is fully cacheable.