mcp.cloudflare.com rejects a custom-scheme redirect URI (invalid_request) while the observability server accepts the same client and scheme

## Summary

Two of the Cloudflare MCP servers disagree about which OAuth redirect URIs they accept. `mcp.cloudflare.com` (the API server) refuses a custom-scheme redirect URI with `invalid_request: Redirect URI must use HTTPS or a local loopback address`, while the observability server accepts the same client and the same custom scheme and connects. A client that works against one Cloudflare MCP server therefore fails against another with no way to tell in advance.

## Steps

1. From the Claude desktop app (Windows 11), connect the `cloudflare-observability` MCP server via its OAuth flow. It succeeds.
2. From the same app, connect the API server at `https://mcp.cloudflare.com/mcp`. The browser opens (one-time values elided):

`https://mcp.cloudflare.com/authorize?response_type=code&client_id=...&code_challenge=...&code_challenge_method=S256&redirect_uri=claude%3A%2F%2Fclaude.ai%2Fmcp-auth-callback%2Fsdk&state=...&resource=https%3A%2F%2Fmcp.cloudflare.com%2Fmcp`

3. Before any login, the authorize page answers:

> Invalid Request
> Redirect URI must use HTTPS or a local loopback address
> Error code: invalid_request

4. Connecting the same API server from the Claude terminal CLI, whose flow uses a loopback redirect, succeeds.

## What is being asked

Either both servers apply the same redirect rule (the RFC 8252 one the API server enforces, with the observability server tightened to match, or the custom-scheme allowance the observability server has, extended to the API server), or the API server documents that native clients must present a loopback redirect. Today the two behave differently for the same client, and the error surfaces on the authorize page rather than at dynamic client registration, where a client could react to it.

## Notes

- The client-side half is reported at anthropics/claude-code#93671 (the desktop app depends on a custom-scheme redirect).
- Observed 2026-09-11 with the Claude Code Cloudflare plugin's `cloudflare-api` and `cloudflare-observability` servers.

Start at the API server's /authorize flow and compare its redirect-URI validation with the cloudflare-observability server. Reproduce both custom-scheme and loopback redirects using the request details in the issue, then determine and apply one consistent rule or document the native-client requirement. Done means the two servers no longer disagree without a clear, actionable response.

Written by the indexing model from the issue text.