fix: need to redirect back to Auth0 with a signed token, not just return a response (AAI-877)

[marius-mather]

Description

AAI-877: while implementing the Auth0 action, realised the backend can't just return a response with the required data - it has to do a redirect, and we need to embed the data in a token for security.

We also can't do the linking call to Auth0 here - it interferes with login, see: https://support.auth0.com/center/s/article/Unable-to-process-redirect-callback. That has been moved to the Auth0 action side.

Changes

• /aaf/check-link endpoint now returns a redirect to Auth0, with response data embedded in the session_token parameter
• Don't link the accounts from the backend - pass the identity to link back to Auth0, so it can link
• create_action_token function to create signed tokens for Auth0
• Unit tests

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have added unit / integration tests that prove my fix is effective or that my feature works
• I have run all tests locally and they pass
• I have updated the documentation (if applicable)
• For any new secrets, I have updated the shared spreadsheet and the GitHub Secrets.

How to Test Manually (if necessary)

Run uv run pytest

[amandazhuyilan]

Look aligned with the auth0 docs suggestions - thanks for catching this