Three-step wire-up for the AR/AP integration. Mints a refresh token your operator pastes into Key Vault as XERO_REFRESH_TOKEN. Gated on admin.integrations.
This bounces you to Xero, asks you to sign in and choose the org NEOM should write AR/AP drafts into, then brings you back to step 3. We sign the request with a CSRF state cookie so a replay from another tab can't piggy-back the dance.