feat(github): allow extra OAuth redirect hosts via env var

[viktormarinho]

Problem

oauth.allowedRedirectHosts was a source literal pinned to decocms.com, so a
self-hosted Mesh/Studio on its own domain could not complete the GitHub OAuth
flow at all — GitHub delivers the authorization code to the redirect_uri,
and this server refuses to hand GitHub a callback outside the allowlist.

Change

EXTRA_ALLOWED_REDIRECT_HOSTS — a comma-separated list of extra host suffixes,
merged with the built-in decocms.com:

• entries may be pasted as a full callback URL and are reduced to their host
  (matching is per-host, the path is irrelevant);
• lowercased, trimmed, deduped (including against the built-in);
• single-label values (com, localhost) are rejected, because as a suffix
  they would open a whole TLD;
• unusable entries are logged and skipped instead of throwing, so one typo in
  the list cannot take OAuth down for every install.

Hosts live in deployment config rather than in source on purpose, so no
install-specific hostname lands in this public repo.

Each added host is one more origin that can receive a user's authorization
code, so this is documented as "only hosts you trust as much as
decocms.com".

Note for deployers

Adding a host takes two steps, both documented in the README: the env var
here, and the exact callback URL under the GitHub App's Callback URL setting
(GitHub Apps allow several). Without the second, GitHub rejects the authorize
request regardless of what this server permits.

Test plan

• bun test in github/ — 133 pass / 0 fail, including 9 new cases in
  server/constants.test.ts (bare host, full URL, casing/whitespace,
  single-label rejection, unparseable entries, dedupe, partial-failure).
• bun run check — no errors in github/server/** (remaining tsc output
  is pre-existing noise from @decocms/runtime in node_modules).

---

Summary by cubic

Previously, GitHub OAuth callbacks were limited to decocms.com, preventing self-hosted Mesh/Studio deployments from completing OAuth. The server now accepts additional hosts through EXTRA_ALLOWED_REDIRECT_HOSTS; invalid entries are logged and skipped, and each added host must be trusted to receive authorization codes.

Migration

• Set EXTRA_ALLOWED_REDIRECT_HOSTS to a comma-separated list of trusted host suffixes or callback URLs.
• Add the exact callback URL to the GitHub App’s Callback URL settings; GitHub rejects the authorization request without it.

^{Written for commit 3e53dd6. Summary will update on new commits.}