fix: avoid OAuth redirect URI warning

[rossgalloway]

Summary

Fixes the GitHub OAuth warning shown during sign-in:

Be careful! The redirect_uri is not associated with this application.

The warning appeared after the previous OAuth change started sending an explicit redirect_uri from the browser. That value was derived from the runtime/API origin, so GitHub required every deployed domain or preview URL to be registered on the OAuth App. When the current host was not registered, GitHub showed the warning before login.

Fix

• Stop sending redirect_uri in the browser authorize URL.
• Stop sending redirect_uri during the token exchange.
• Let GitHub use the OAuth App's registered callback URL.
• Keep APP_BASE_URL responsible for redirecting from the API callback back to the SPA.
• Update the image-tools README to document the callback configuration.

Validation

• bun run typecheck
• bun run build

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
token-assets	Ready	Preview, Comment	Jul 8, 2026 5:41pm
token-assets-ui	Ready	Preview, Comment	Jul 8, 2026 5:41pm