Inconsistent return type in parseUriList leads to incorrect OAuth redirectUri handling

Description

What: parseUriList(userUri) returns a string instead of a consistent array type.

Where: parseUriList.ts (used by updateOAuthApp and addOAuthApp)

Problem:
Callers expect an array-like redirectUri (e.g., checking .length, storing in DB). Returning a string may pass some checks but leads to incorrect runtime behavior and inconsistent DB schema (string vs array).

Steps to Reproduce

1. Call parseUriList('https://example.com') → returns a string
2. Call parseUriList('https://a.com,https://b.com') → returns a comma-separated string
3. Observe incorrect handling in OAuth flows

Impact

• Subtle runtime bugs
• Inconsistent database entries
• Issues in OAuth redirect validation

Expected Behavior

parseUriList should always return string[]:

• Empty input → []
• Single URI → ['uri']
• Multiple URIs → ['uri1', 'uri2']

Possible Solution

Update parseUriList to always return an array of trimmed URIs.
Add unit tests for empty, single, and multiple inputs.
(Optional) Migrate existing string values in DB to arrays.

Start in parseUriList.ts and trace its use from updateOAuthApp and addOAuthApp. Verify the current behavior for empty, single, and comma-separated URI inputs, then add unit tests covering those cases. Done means parseUriList consistently returns trimmed string arrays and the OAuth callers handle redirectUri with that shape.