fix(dev): support 127.0.0.1 dev OAuth end-to-end

Re-add the 127.0.0.1 callbacks to the dev host allowlist (now registered in the
Google console alongside the localhost ones). Deriving the redirect_uri from the
request host keeps the whole round-trip — login, Google callback, and the
session/state cookie — on one origin; a cross-host fallback (127.0.0.1 → the
fixed localhost callback) would silently lose the OAuth state, since a session
cookie set on 127.0.0.1 is never sent to localhost. Clarify that in the comment
and cover all four hosts in the unit test.

backend/tests/test_oauth_redirect.py

@@ -28,8 +28,12 @@ def _prod_settings():
 
 def test_dev_known_host_returns_to_that_origin(monkeypatch):
     monkeypatch.setattr(auth, "settings", _dev_settings())
+    # Each allowlisted host keeps the whole round-trip on one origin (all four are registered in the
+    # Google console), so the redirect_uri matches the host the flow started on.
     assert auth._oauth_redirect_uri(_req("localhost:5173")) == "http://localhost:5173/auth/callback"
     assert auth._oauth_redirect_uri(_req("localhost:8080")) == "http://localhost:8080/auth/callback"
+    assert auth._oauth_redirect_uri(_req("127.0.0.1:5173")) == "http://127.0.0.1:5173/auth/callback"
+    assert auth._oauth_redirect_uri(_req("127.0.0.1:8080")) == "http://127.0.0.1:8080/auth/callback"
 
 
 def test_dev_host_is_case_insensitive(monkeypatch):
@@ -40,9 +44,6 @@ def test_dev_host_is_case_insensitive(monkeypatch):
 def test_dev_unknown_or_missing_host_falls_back_to_configured(monkeypatch):
     monkeypatch.setattr(auth, "settings", _dev_settings())
     # An origin not on the allowlist (or a request with no Host) must not drive the redirect.
-    # 127.0.0.1 is deliberately NOT allowlisted (not registered in the Google console), so it falls
-    # back to the fixed configured callback rather than producing a redirect_uri_mismatch.
-    assert auth._oauth_redirect_uri(_req("127.0.0.1:5173")) == "http://localhost:8080/auth/callback"
     assert auth._oauth_redirect_uri(_req("evil.example.com")) == "http://localhost:8080/auth/callback"
     assert auth._oauth_redirect_uri(_req(None)) == "http://localhost:8080/auth/callback"