* fix: broaden OAuth redirect_uri allowlist for Claude Desktop
Claude Desktop uses varying callback paths (with org/connector IDs),
not a single fixed callback URL. Allow any path under claude.ai and
claude.com instead of requiring an exact match.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: tighten redirect_uri allowlist to /api/ prefix only
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>