Fix callback OAuth YouTube: pagina HTML con refresh token invece di risposta API vuota.

Il codice OAuth va usato una sola volta; messaggio chiaro se si ricarica il callback.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/controllers/youtube_oauth_callback_controller.rb

@@ -0,0 +1,42 @@
+# Callback OAuth YouTube (HTML). Non usare Api::V1 — ActionController::API non renderizza le view.
+class YoutubeOauthCallbackController < ActionController::Base
+  layout "admin"
+
+  def show
+    return redirect_to_oauth_error("Codice OAuth mancante") if params[:code].blank?
+
+    ctx = Youtube::OauthState.verify!(params[:state])
+    tokens = Youtube::OauthExchange.call(params[:code])
+
+    if ctx[:kind] == :platform
+      @refresh_token = tokens[:refresh_token]
+      @channel_title = tokens[:channel_title]
+      return render "admin/youtube/platform_token"
+    end
+
+    user = User.find(ctx[:user_id])
+    team = user.manageable_teams.find(ctx[:team_id])
+    cred = team.youtube_credential || team.build_youtube_credential
+    cred.update!(
+      access_token: tokens[:access_token],
+      refresh_token: tokens[:refresh_token] || cred.refresh_token,
+      expires_at: Time.current + tokens[:expires_in].seconds,
+      channel_id: tokens[:channel_id],
+      channel_title: tokens[:channel_title]
+    )
+    redirect_to "#{public_base_url}/teams/#{team.id}/dettagli?youtube=connected", allow_other_host: true
+  rescue ArgumentError, Youtube::BroadcastService::Error => e
+    redirect_to_oauth_error(e.message)
+  end
+
+  private
+
+  def public_base_url
+    MatchLiveTv.app_public_url.chomp("/")
+  end
+
+  def redirect_to_oauth_error(message)
+    redirect_to "#{public_base_url}/prezzi?youtube_error=#{ERB::Util.url_encode(message)}",
+                allow_other_host: true
+  end
+end