feat(dev): OAuth redirect returns to the origin that started it

A Google login started on the Vite dev server (:5173) always came back to the
fixed :8080 callback, because login/link/upgrade passed the static
settings.oauth_redirect_url. Derive the redirect_uri from the request origin
instead, but only in local dev and only for a known dev-host allowlist —
production still uses the fixed configured URL and never trusts the Host header
(host-injection guard). Set the Vite proxy to changeOrigin:false so it forwards
the real Host:localhost:5173 (it was rewriting it to the 127.0.0.1:8080 target).
Both callbacks must be registered in the Google console.

frontend/vite.config.ts

@@ -5,10 +5,15 @@ import react from "@vitejs/plugin-react";
 // Use 127.0.0.1 (not "localhost") so Node doesn't resolve to IPv6 ::1, which the
 // Docker port publish may not answer — that surfaces as proxy connection failures.
 const target = "http://127.0.0.1:8080";
+// changeOrigin:false keeps the original `Host: localhost:5173` header when proxying to the backend
+// (the TCP target is still 127.0.0.1:8080 — changeOrigin only rewrites the header). The backend uses
+// that header to send the OAuth redirect_uri back to :5173, so a Google login started on the Vite dev
+// server returns to :5173 instead of the fixed :8080 callback. (Both are registered in the console.)
+const proxyOpts = { target, changeOrigin: false };
 const proxy = {
-  "/api": target,
-  "/auth": target,
-  "/healthz": target,
+  "/api": proxyOpts,
+  "/auth": proxyOpts,
+  "/healthz": proxyOpts,
 };
 
 export default defineConfig({