Invalid callback URL

## Problem

## Steps to reproduce the issue

1. Go to Workforce signin, fill the fields with the correct information (startUrl and region)
2. Being redirected to browser (already connected to my SSO on another tab)
3. See error

```
An error occurred while signing in to the application
Invalid callback URL
Confirm with your administrator that you have access to the application and that your primary email address is assigned in IAM Identity Center.
```

## System details (run `AWS: About` and/or `Amazon Q: About`)

- OS: MacOS
- Visual Studio Code version: 1.95.3
- AWS Toolkit version: 3.38.0
- Amazon Q version: ?

No file or test is named. Start by reproducing the Workforce signin flow with the reported startUrl, region, macOS, VS Code 1.95.3, and AWS Toolkit 3.38.0, then inspect the browser redirect and callback handling. Done means the SSO flow completes without the “Invalid callback URL” error and the behavior is covered by an appropriate regression test.

Written by the indexing model from the issue text.