fix(mcp-oauth): use fixed localhost base for callback URL parsing

Cubic AI reviewer flagged the use of the untrusted Host header as the
URL base in startCallbackServer. The server only binds to 127.0.0.1,
so hardcoding "http://127.0.0.1" as the URL base is robust against
malformed or manipulated Host values and matches upstream behavior
prior to the node:http refactor.

src/features/mcp-oauth/callback-server.ts

@@ -57,8 +57,7 @@ export async function startCallbackServer(startPort: number = DEFAULT_PORT): Pro
   }, TIMEOUT_MS)
 
   const server = createServer((request: IncomingMessage, response: ServerResponse) => {
-    const host = request.headers.host ?? "127.0.0.1"
-    const url = new URL(request.url ?? "/", `http://${host}`)
+    const url = new URL(request.url ?? "/", "http://127.0.0.1")
 
     if (url.pathname !== "/oauth/callback") {
       response.statusCode = 404