fix: preserve desktop MCP OAuth consent through login

[oshtz]

Closes #119

Summary

Current main now advertises the packaged desktop app's dynamic API and dashboard origins correctly. One part of the MCP OAuth flow remains broken in zero-auth mode: creating the local session drops the pending consent return path, and /mcp/authorize is not accepted by the existing safe returnTo allowlist.

This change:

• preserves the validated MCP consent path when the desktop login page requests a zero-auth session
• relays that path through /api/auth/desktop-login and back through the dashboard's existing redirect validator
• allows /mcp/authorize in the safe relative-path allowlist while continuing to reject external redirects
• adds focused regression coverage for the MCP consent return path

The branch is rebased on current main and leaves its OPENSHIP_ADVERTISED_ORIGIN implementation unchanged.

Testing

• dashboard test suite: 27 tests pass
• API and dashboard TypeScript checks pass
• external and protocol-relative returnTo values remain rejected

[Hydralerne]

cool