Support wildcard redirect_uri patterns for OAuth clients

theta42/proxy fronts an arbitrary number of hosts behind SSO, each with its
own callback URL (https://<host>/__proxy_auth/callback) — proxy's own code
comment already assumed "a wildcard redirect URI covers all", but no
wildcard matching existed here, so every proxied host's callback had to be
registered on the shared OAuth client individually or /oauth/authorize
would reject it with InvalidRedirectURI.

Add `*` (one hostname label) / `**` (any number of labels) wildcard support
to redirect_uri matching, e.g. `https://**.example.com/__proxy_auth/callback`
now covers every host proxy fronts under example.com. Exact matches still
work exactly as before.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

API.md

@@ -905,7 +905,9 @@ Returns the OIDC discovery document with endpoint URLs, supported scopes, and si
 **Query Parameters:**
 - `response_type` — Must be `code`
 - `client_id` — Registered OAuth client ID
-- `redirect_uri` — Must exactly match a URI registered for the client
+- `redirect_uri` — Must match a URI registered for the client, either exactly
+  or against a registered wildcard pattern (`*` = one hostname label, `**` =
+  any number of labels)
 - `scope` — Space-separated: `openid`, `profile`, `email`
 - `state` — Opaque value returned unchanged in the redirect
 - `code_challenge` — PKCE challenge (SHA-256 of code_verifier, base64url-encoded)