Everything below maps 1:1 to a MusoraWidget.render() option. Redirects are
intercepted so you can inspect the handoff URL instead of leaving the page.
Isolation test →
To test the real handoff, run the platform locally with
VITE_FF_OAUTH_SIGN_IN=1, set signInUrl to
https://localhost.com:5173/, and untick nothing — the redirect is only
intercepted on this page.