fix: derive OAuth callback URLs from request headers (#333)

[luthien-m]

Summary

OAuth callback URLs were hardcoded to the static baseUrl computed at startup (defaults to http://localhost:3050). When AgentGate runs behind a reverse proxy, Google/Fitbit/etc redirect to localhost instead of the real server.

Changes

src/routes/ui/shared.js:

• Added getBaseUrl(req) — derives base URL per-request
• Priority: BASE_URL env var > X-Forwarded-Proto/X-Forwarded-Host headers > req.protocol/req.headers.host

6 OAuth service files (youtube, calendar, fitbit, linkedin, reddit, mastodon):

• Import getBaseUrl from shared.js
• Replace closure baseUrl with getBaseUrl(req) in route handlers (setup, callback, retry)
• renderCard functions unchanged (display-only, fine with static URL)

How it works

1. If BASE_URL env is set → uses that (explicit config wins)
2. Otherwise reads X-Forwarded-Proto and X-Forwarded-Host from the proxy
3. Falls back to req.protocol/req.headers.host

No config needed when behind a standard reverse proxy that sets forwarding headers.

Closes #333

Testing

• ✅ ESLint: 0 errors
• ✅ All 99 tests pass (8 suites)

[radaghastly]

LGTM. Clean approach — getBaseUrl(req) with the right priority (env > forwarded headers > request). Consistent change across all 6 OAuth services. _baseUrl prefix to avoid lint unused-var is a nice touch. 👍