Charles Schwab live auth fails: callback rejects a valid code ("log in is required before starting authorization")

Re-authenticating my Charles Schwab brokerage for a live deployment fails every time and I'd appreciate guidance.

Setup: cloud live deploy, project 36170999, node L1-1, region America/NY7.

Steps: Deploy Live → Charles Schwab → Authenticate. The Schwab login opens, I log in and approve account access, and Schwab redirects back with a valid code. QuantConnect's callback then returns an error and Authorization stays on “Waiting”. The callback URL is:

/api/v2/live/auth0/callback/brokerage/charlesschwab?brokerage=charlesschwab&code=…&session=…&state=…

and it returns:

{"errors":["For your security, log in it's required before starting a authorization"],"success":false}

This is 100% reproducible. I've ruled out: popups blocked, third-party cookies blocked, timeout (a fast clean retry fails identically), and a stale QC login (logged out and back in fresh - same result). Schwab issues a valid code; the callback rejects it.

Meanwhile the live algorithm errors at Initialize with: CharlesSchwabApiClient.SendRequestAsync: Authentication failed. Details: Error refreshing access token.

This may relate to the new Schwab authentication-refresh rollout. How do I complete the authorization? Thanks.