fix(api): Preserve app redirect_uri through OIDC flow

Apps initiating login with their own redirect target (e.g.
myice://callback for the mobile app) always ended up on the web
frontend because /callback ignored the requested target and
redirected to FRONTEND_URL.

Store the requested target in an httpOnly cookie at /login, validated
against an ALLOWED_REDIRECT_URIS allowlist, and redirect back to it
at /callback on all paths. Re-validate the cookie value when read to
guard against cookie tossing, drop the '/' prefix that broke deep
links on the error path, and URL-encode error details in redirects.

README.md

@@ -103,7 +103,12 @@ To configure OIDC authentication, set the following environment variables:
 - `CLIENT_SECRET`: Your OIDC client secret
 - `REDIRECT_URI`: The redirect URI (default: `http://localhost:8000/callback`)
 - `ALLOWED_USERS`: Comma-separated list of allowed email addresses
-  (e.g., `"user1@example.com,user2@example.com"`)
+  (e.g. `"user1@example.com,user2@example.com"`)
+- `ALLOWED_REDIRECT_URIS`: Comma-separated list of redirect targets external
+  apps may request via `/login?redirect_uri=...` (default: `myice://callback`
+  for the mobile app). Only allowlisted targets are honored; the callback
+  redirects back to the requesting app with the access token in the URL
+  fragment instead of the web frontend.
 
 The web API provides the following endpoints: