Support exact MCP OAuth redirect URIs

[samueleguino97]

Summary

• add optional oauth.redirect_uri configuration for remote MCP servers
• preserve the existing ephemeral http://127.0.0.1:<port>/callback default
• bind configured localhost, 127.0.0.1, or [::1] URLs on their exact port and accept their configured callback path
• reject non-loopback, HTTPS, portless, credential-bearing, query-bearing, and fragment-bearing redirect URIs

Problem

OAuth providers do not agree on one loopback redirect form. Calendly's Dynamic Client Registration endpoint accepts localhost but rejects 127.0.0.1, while other providers require 127.0.0.1. Providers may also require a pre-registered fixed port or callback path.

A global hostname change would fix one provider by breaking another.

Fix

Profile configuration can now provide the exact redirect URI required by a server:

{
  "mcp": {
    "calendly": {
      "type": "http",
      "url": "https://mcp.calendly.com/",
      "oauth": {
        "issuer": "https://calendly.com",
        "redirect_uri": "http://localhost:3118/callback"
      }
    }
  }
}

When omitted, behavior remains unchanged: fx binds an ephemeral port on 127.0.0.1 and advertises http://127.0.0.1:<port>/callback.

The configured value is restricted to an exact HTTP loopback URL with an explicit nonzero port. fx binds the corresponding loopback interface and validates the incoming request against the configured path. The exact URI is reused for client registration, authorization, and token exchange.

This covers the hostname and path cases in addition to the fixed-port use case discussed in #491.

Verification

• zig fmt --check src/ passed
• focused Zig OAuth/config tests passed
• zig build passed
• zig build test passed, exit code 0
• focused E2E passed: bun test mcp-auth.test.ts -t 'configured OAuth redirect URI binds the exact loopback callback' (1 pass, 0 fail)
• the full mcp-auth.test.ts run passed the new test; one unrelated cache-ordering case failed transiently, then passed alone (1 pass, 0 fail)
• Calendly Dynamic Client Registration accepted http://localhost:43118/oauth/callback with HTTP 201 and returned that exact URI