fix(mcp): bind oauth callback to IPv4 loopback

[he-yufeng]

Issue for this PR

Closes #30013

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

The MCP OAuth callback server used server.listen(port) without a host. On Linux this can bind to the IPv6 wildcard address. In WSL2, callbacks opened in the Windows browser can fail to reach that socket through localhost forwarding.

This binds the callback server to 127.0.0.1 explicitly, matching the default redirect URI and keeping the server loopback-only. The port-in-use probe already checks 127.0.0.1, so startup detection and the actual listener now use the same address family.

How did you verify your code works?

• bun --cwd packages/opencode test test/mcp/oauth-callback.test.ts
• bun run --cwd packages/opencode typecheck
• bunx prettier --check packages/opencode/src/mcp/oauth-callback.ts packages/opencode/test/mcp/oauth-callback.test.ts
• bunx oxlint packages/opencode/src/mcp/oauth-callback.ts packages/opencode/test/mcp/oauth-callback.test.ts
• git diff --check

Screenshots / recordings

No screenshot. This changes local OAuth callback socket binding, not UI layout.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR