Support localhost OAuth callback handoff for hosted browsers

[eladrave]

Summary

• add a browser completion dialog for remote-control OAuth flows that redirect to localhost
• validate pasted callbacks and forward them only to loopback listeners on ports 1455 or 1457
• implement safe shell.openExternal forwarding for authorization links
• document the hosted-browser flow and add focused security and forwarding tests

Why

Remote-control authorization uses a registered callback such as
http://localhost:1455/auth/callback. When codex-web runs on another machine,
the user's browser is redirected to its own localhost rather than the machine
running the Codex listener, so authorization cannot complete.

For recognized remote-control authorization URLs, this change presents a
user-clicked authorization link and asks the user to paste the complete
localhost callback URL after OpenAI redirects. The callback then travels over
the existing browser IPC WebSocket and is forwarded internally to the
server-side loopback listener.

Security

• no public callback endpoint is added
• only HTTP localhost callbacks using /auth/callback on ports 1455 and 1457 are accepted
• callbacks must contain state and either code or error
• callback URLs with credentials, fragments, other hosts, paths, protocols, or ports are rejected
• the callback is not logged, persisted, or included in forwarding errors
• external URL forwarding permits only HTTP and HTTPS

Validation

• npm ci
• npm test
• npm run build:browser
• git diff --check
• five passing tests covering safe external links, invalid callback variants, loopback forwarding, and callback-value redaction from errors