I'm still trying to build my solution, but it's essentially what is described in the documentation on Token Exchange. There is no installation endpoint; every request made to the iframe in an embedded app includes the information required for Shopify App Bridge to make session tokens in the frontend, which you then include in every call to your backend to exchange them for access tokens. It's not unreasonable to make a call when the iframe is first loaded specifically to give your backend a chance to store an offline access token for the shop.
