feat: redirect_uri dynamique basé sur Host header

Avant: oauth_redirect_uri codé en dur à localhost:8080
→ impossible d'utiliser l'OAuth depuis une autre machine du réseau

Après: le redirect_uri est construit à partir du header Host de la requête
→ localhost:8080 → http://localhost:8080/auth/callback
→ 192.168.30.101:8080 → http://192.168.30.101:8080/auth/callback

⚠️ L'utilisateur doit ajouter les 2 URIs dans Gitea OAuth App settings.

app/routers/auth.py

@@ -115,7 +115,10 @@ async def login(request: Request, provider: str = Query("gitea")):
     state = secrets.token_hex(32)
     request.session["oauth_state"] = state
     request.session["oauth_provider"] = provider
-    auth_url = oauth_provider.get_authorize_url(state)
+    # Dynamic redirect URI based on incoming Host header
+    host = request.headers.get("host", "localhost:8080")
+    dynamic_redirect_uri = f"http://{host}/auth/callback"
+    auth_url = oauth_provider.get_authorize_url(state, redirect_uri=dynamic_redirect_uri)
     return RedirectResponse(url=auth_url, status_code=302)
 
 
@@ -237,8 +240,10 @@ async def callback(
     if not oauth_provider:
         return HTMLResponse(f"<h1>Unknown provider: {provider_name}</h1>", status_code=400)
 
-    # Exchange code for token
-    token_data = await oauth_provider.exchange_code(code)
+    # Exchange code for token — use dynamic redirect URI matching the authorize step
+    host = request.headers.get("host", "localhost:8080")
+    dynamic_redirect_uri = f"http://{host}/auth/callback"
+    token_data = await oauth_provider.exchange_code(code, redirect_uri=dynamic_redirect_uri)
     if not token_data:
         return HTMLResponse("<h1>Token exchange failed</h1>", status_code=400)