Support pasted localhost OAuth callbacks for remote BB

[mattwynne]

Why

MCP servers such as Fastmail dynamically register localhost redirects, but BB may run on a different machine from the user's browser. When the browser reaches an unreachable localhost callback, users need a safe way to complete the pending OAuth exchange without routing their login page through BB.

Changes

• Normalize BB's loopback redirect to http://localhost for compatible MCP dynamic registration.
• Add a Finish sign-in form that submits the full failed browser redirect directly to the existing finishAuthentication RPC, not through an agent or chat.
• Validate the pasted callback's origin, path, and server context before state and PKCE checks; make the callback route accessible without a BB browser session.
• Document the one-off paste-back flow; keep code and state out of UI errors.

Evidence

• 89 package tests and typecheck pass.
• Installed at a pinned commit into an isolated BB 0.45.0 instance: read-only Fastmail OAuth, mail/calendar/contacts reads, and restart persistence worked. No writes or production deployment.

[patleeman]

Thanks Matt! This is a really nice fix. Remote BB + Fastmail OAuth has been a pain point for me too, and the paste-back flow with strict callback validation is a clean way to handle it. Merged.