security: allowlist DCR redirect_uri hosts (fixes consent-phishing / account takeover)

Unauthenticated DCR previously accepted any redirect_uri; combined with the
auto-approving /consent handler an attacker could register a client pointing at
their domain, phish a logged-in user, and silently receive an auth code for the
victim's identity. Reject non-allowlisted redirect_uri hosts at registration
(default: claude.ai, claude.com, and the BETTER_AUTH_URL/portal host).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -22,6 +22,12 @@ VALID_AUDIENCES=https://intervalsicu.farhoodlabs.com/mcp
 # Comma-separated trusted origins for Better Auth.
 TRUSTED_ORIGINS=https://intervalsicu.farhoodlabs.com
 
+# Comma-separated hostnames allowed as DCR client redirect_uri hosts. When unset,
+# defaults to claude.ai, claude.com and the BETTER_AUTH_URL host (the portal).
+# This is a security control: it blocks attacker-registered clients from pointing
+# authorization codes at their own domain. Set only to override the defaults.
+# ALLOWED_REDIRECT_HOSTS=claude.ai,claude.com,intervalsicu.farhoodlabs.com
+
 # Logger level: debug | info (default info).
 LOG_LEVEL=info
 # HTTP listen port (default 8080).