[omouren]

Summary

• cfg.OAuthClient.RedirectURL is process-global. With several oauth.callback_urls, /login selected a callback from the request Host and overwrote that global value, while /auth/{state}/ later exchanged the code without selecting it again.
• Concurrent logins, or another instance behind the same load balancer, could therefore send the provider a different redirect_uri and receive oauth2: "redirect_uri_mismatch".
• Each request now gets a shallow copy of the OAuth config. The existing callback selection rule is used both when building the authorization URL, including IndieAuth, and when exchanging the code. The shared client is never changed after startup.
• An empty matched domain no longer selects the first callback through strings.Contains(url, ""). A single oauth.callback_url still behaves exactly as before.

Test plan

• Two hosts configured through oauth.callback_urls each send their own redirect_uri on both the authorization redirect and the token exchange.
• Resolving a second host does not change the redirect URL already selected for the first host, nor the startup value on cfg.OAuthClient.
• An empty callback_urls list keeps the single startup callback URL.
• An empty or unmatched Host keeps that startup URL and logs the existing no-match message.
• go test ./... passes with VOUCH_ROOT set.