Update SDK example callback and integration guidance to treat UserInfoException as an authorization-state outcome (e.g. subject disabled/inactive scope) and return a clear 403 path.
Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
Andy Dixon