connectors 0.3.3

Fixed

• Complete Claude subscription OAuth from the provider's exact manual-callback value: split its
  authorization_code#state form, verify the returned state against the pending browser flow, and
  exchange only the authorization-code component. Missing, mismatched, or multiply delimited state
  is refused before any token-endpoint request.

Security

• Keep the correction wholly inside Connectors. Identity remains provider- and relying-party-
  agnostic, while Connectors continues to own provider state, PKCE material, and token custody.

Full Changelog: v0.3.2...v0.3.3