Fix Freebuff CLI auth code handling

[jahooma]

Summary

• Generate CLI login URLs from the request origin to avoid apex/www host drift during OAuth.
• Parse CLI auth codes from the right and trim copied values so validation handles malformed copies and dotted fingerprint IDs.
• Add diagnostic Freebuff logging for invalid auth-code validation without logging full codes or hashes.

Tests

• bun test web/src/app/onboard/tests/helpers.test.ts
• bun run --cwd web test -- --runTestsByPath src/app/onboard/tests/helpers.test.ts --runInBand
• bun run --cwd freebuff/web typecheck
• bun run --cwd web typecheck