Support wildcard redirect_uri patterns for OAuth clients

theta42/proxy fronts an arbitrary number of hosts behind SSO, each with its
own callback URL (https://<host>/__proxy_auth/callback) — proxy's own code
comment already assumed "a wildcard redirect URI covers all", but no
wildcard matching existed here, so every proxied host's callback had to be
registered on the shared OAuth client individually or /oauth/authorize
would reject it with InvalidRedirectURI.

Add `*` (one hostname label) / `**` (any number of labels) wildcard support
to redirect_uri matching, e.g. `https://**.example.com/__proxy_auth/callback`
now covers every host proxy fronts under example.com. Exact matches still
work exactly as before.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/oauth.md

@@ -36,7 +36,11 @@ An OAuth client represents an app that authenticates against the SSO. Each has:
 - `client_id` (UUID) + `client_secret` (bcrypt-hashed; the **raw secret is
   shown once** when the client is created or rotated — save it immediately).
 - `name`, `description`, `created_by` (the admin uid that created it).
-- `redirect_uris` — allowed callback URLs (must match exactly).
+- `redirect_uris` — allowed callback URLs. Each entry matches exactly, or may
+  use `*` (one hostname label) / `**` (any number of labels) as a wildcard —
+  e.g. `https://*.example.com/__proxy_auth/callback` covers every host
+  theta42/proxy fronts under `example.com`, so you don't have to register
+  each proxied host's callback individually.
 - `scopes` — requested scopes (default `openid profile email groups`).
 - `allowed_groups` — restrict the client to members of specific SSO groups
   (empty = any valid user).