Use the hosted local CIMD document only on loopback origins

[Abhishek-B-R]

Summary

A local Executor opened through a public HTTPS reverse proxy still sends https://executor.sh/api/oauth/client-id-metadata/local.json as its OAuth client_id, because oauthClientIdMetadataDocumentUrl() picks the hosted local document whenever a hosted base URL is configured. That document only lists loopback callbacks, while the redirect_uri is built from the public origin, so providers that support Client ID Metadata Documents (Linear's MCP server, for example) reject the request with "Invalid redirect URI".

This uses the hosted local document only when the page is on a loopback origin (localhost, 127.0.0.1 or [::1]), or outside the browser as before. On any other origin it falls through to the existing current origin path, so the document it points at advertises the same callback the flow sends.

Linked issue

Closes #2073

Verification

Added two cases to packages/react/src/plugins/oauth-sign-in.test.ts:

• an IPv6 loopback origin still gets the hosted local.json
• a public reverse proxy origin gets its own default.json

The reverse proxy case fails on main and passes here.

• oxfmt --check on the changed files: clean
• oxlint -c .oxlintrc.jsonc --deny-warnings on the changed files and bun run lint:changelog-stubs: clean
• tsgo --noEmit in packages/react: exit 0
• vitest run in packages/react: 455 passed (50 files)
• e2e: not run; the change is covered by the unit tests above

Checklist

• Added a changeset (bun run changeset), or this change needs none.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.