fix(cli): support fixed OIDC callback ports

[afourniernv]

Summary

Adds an optional fixed loopback callback port for the generic CLI OIDC Authorization Code plus PKCE flow. This lets operators use IdPs that require an exact pre-registered redirect URI.

Related Issue

Supports NVIDIA/NemoClaw#6871. This PR deliberately contains no IdP profile, provider integration, or tenant configuration.

Changes

• Add OPENSHELL_OIDC_CALLBACK_PORT with validation for a non-zero TCP port.
• Keep the existing ephemeral loopback callback behavior as the default.
• Document use with a pre-registered redirect URI.

Testing

• mise run pre-commit passes.
• cargo test -p openshell-cli oidc_auth::tests passes, 13 tests.
• mise run docs passes.
• E2E tests are not needed for a local CLI callback binding change.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Documentation updated.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.