Fix Trello fragment-based OAuth callback

[ChrisAceda]

Summary

Trello authorization and card creation were failing at two separate stages.

First, Trello returns its OAuth token in the URL fragment because the authorization request uses callback_method=fragment. URL fragments are browser-only and are not sent to the server, so the existing callback handler received no token and returned invalid_request.

After authorization was fixed, feedback submissions still failed to create Trello cards because the event hook configuration did not include the Trello API key.

Changes

• Add a Trello-specific browser bridge that reads the fragment token.
• POST the token to the existing callback endpoint.
• Add POST handling to the integration callback route.
• Preserve the existing signed-state, state-cookie, session, and principal validation.
• Add focused tests for the bridge response and security headers.
• Pass TRELLO_API_KEY to Trello event hooks as apiKey.
• Leave the configuration of other integrations unchanged.

Security

• The token is not copied into the query string.
• It is kept out of browser history, referrers, and reverse-proxy request logs.
• The bridge uses Cache-Control: no-store, a restrictive CSP, framing protection, and Referrer-Policy: no-referrer.
• The Trello API key and access token are not written to application logs.

Testing

• Production Docker image built successfully.
• Tested against a live self-hosted Quackback installation.
• Trello authorization completed successfully.
• The integration was created and appeared in Quackback.
• Confirmed the callback flow uses an initial GET followed by a browser POST.
• Confirmed the token does not appear in callback request URLs.
• Submitted new feedback with the Trello integration enabled.
• Confirmed the post.created event reached the Trello hook.
• Confirmed a Trello card was created in the configured board and list.
• Original source commit: a8e4a63fdbf8193445a144222fde7b9fb103b35e.
• Latest patch commit: 78c92034.

[CLAassistant]

All committers have signed the CLA.