fix(oauth): allow ephemeral loopback redirect ports

[qtjg]

Summary

This updates the OAuth 2.1 authorization endpoint to support RFC 8252 loopback-interface redirect URIs with ephemeral ports.

What changed

• Preserve exact redirect URI matching for all non-loopback URIs and for every URI component other than the port.
• Allow a requested http redirect to use a different port when the registered and requested hosts are the same loopback host: localhost, 127.0.0.1, or ::1.
• Keep scheme, host, user info, path, query, fragment, and opaque URI data unchanged when applying the exception.
• Add focused regression coverage for IPv4, IPv6, and localhost ephemeral ports, plus rejection of path, query, host, HTTPS-port, and custom-scheme differences.

This addresses issue #2703. RFC 8252 Section 7.3 requires authorization servers to allow any port for loopback IP redirect URIs so native clients can bind an ephemeral local port.

Validation

• go test ./internal/api/oauthserver -run '^TestIsValidLoopbackRedirectURI$' -count=1 — passed.
• go vet ./internal/api/oauthserver — passed.
• go test ./internal/api/oauthserver -count=1 — the package reached its database-backed tests, but the sandbox has no PostgreSQL service listening on localhost:5432, so those suites could not run here (connect: connection refused).

The implementation was also reviewed against the repository’s existing redirect URI validation rules and preserves exact matching outside the RFC 8252 loopback exception.