feat(mcp): add oauth callbackHost config

[chrisolszewski]

Adds mcp.<name>.oauth.callbackHost to control the bind address for the OAuth callback server. This helps in WSL2, Docker, and devcontainers where the host browser can’t reach the callback listener.

Default behavior is unchanged when unset. When set, we pass hostname to Bun.serve() and restart the callback server if the host changes.

Also escapes the callback error page output and documents the troubleshooting step in the MCP server docs.

Testing:

• bun run typecheck
• bun test test/mcp/oauth-callback.test.ts
• bun test test/config/config.test.ts

Fixes #9081