Validate redirect URIs at OAuth registration and authorize

[dgellow]

Open dynamic client registration accepted any redirect_uri value without validation. An attacker could register a client whose redirect URI pointed at their own host, then use the auth flow to collect a victim's authorization code at that host. Adds an allowedRedirectUriHosts allowlist enforced at /register and re-checked at /authorize. Required in non-dev. Set allowAnyRedirectUriHost to opt out for development.

Also moves redirect_uri validation up front in /authorize so failures there return a direct 400 instead of 302'ing to the raw query value, per RFC 6749 §3.1.2.4. The standard OAuth error channel (302 to a registered URI with ?error=...) is preserved for other validation failures.

[gemini-code-assist]

Code Review

This pull request implements a redirect-URI host allowlist policy for OAuth client registration and authorization to prevent open redirect vulnerabilities. It introduces new configuration options, allowedRedirectUriHosts and allowAnyRedirectUriHost, along with structural validation checks and comprehensive tests. Feedback focuses on ensuring the file: scheme is explicitly blocked across configuration loading, static validation, and runtime checks to align with the documentation. Additionally, there is a recommendation to refine the port matching logic to handle default ports more flexibly, ensuring that explicit ports in the allowlist correctly match URIs where the port is omitted but implied.