Remove the http://localhost:9926 redirectUri fallback — silent loopback default turns missing config into an authorization-code interception hazard

### Problem

`src/lib/config.ts:177`:

```ts
const baseRedirectUri = expandedOptions.redirectUri || pluginDefaults.redirectUri || 'http://localhost:9926/oauth';
```

A server-side authorization plugin silently falls back to a **plain-HTTP loopback** redirect base when `redirectUri` isn't configured. Observed live on a Fabric-hosted deployment: the GitHub IdP hop was constructed as `redirect_uri=http://localhost:9926/oauth/github/callback`, so every connector authentication dead-ended at GitHub's "redirect_uri is not associated with this application" interstitial.

### Why it's a security issue, not just a config footgun

GitHub happens to fail safe with a warning page. An IdP with a looser redirect policy (several treat loopback redirects permissively for native-app flows) would deliver the **authorization code to whatever is listening on the end user's own localhost:9926**. A silent default converts a missing config value into a code-interception hazard instead of a loud startup failure.

### Fix

1. Remove the localhost fallback entirely: no `redirectUri` and no derivable public base → **fail closed at config load** with an error naming the missing key.
2. When `mcp.issuer` is configured, derive provider callbacks as `issuer + '/oauth//callback'` — this matches the callback shape the enable tooling already instructs operators to register, and it keeps the value env-driven. (Consumer-side note: the obvious consumer fix `redirectUri: ${PUBLIC_URL}/oauth` is defeated by Harper's whole-token-only env interpolation — tpsdev-ai/flair#1180 — which is exactly why the derivation belongs plugin-side.)
3. If a literal loopback base is ever legitimate (local dev), make it opt-in and log it loudly at startup.

Start at src/lib/config.ts:177 and trace configuration loading and redirect URI derivation for the server-side authorization plugin. Check how mcp.issuer and plugin defaults are handled, then verify that missing configuration fails with an error naming the missing key, provider callbacks use the issuer shape, and any loopback behavior is explicitly opted in and logged.

Written by the indexing model from the issue text.