/auth/meta/connect → Facebook dialog →
/auth/meta/callback), persists per-org tokens via
Infisical, then proves the saved token works by listing the user's
ad accounts via the Graph API. Disconnect clears the org's token
locally (upstream revoke is a follow-up).