Surface OAuth callback URL on the Settings page

[murbard]

Summary

Operators hitting Error 400: redirect_uri_mismatch on Google's OAuth consent screen had no easy way to discover what URL Sieve actually sends as the OAuth redirect_uri. The Settings page lets them configure public_base_url but never tells them the resulting callback URL to register on the provider side.

Computes and displays the full callback URL right under the public_base_url input, in a copy-pasteable code block (select-all styling). The value is derived via the same s.publicBaseURL(r) helper that googleOAuthConfig.RedirectURL uses, so what the operator sees is byte-for-byte the URL Sieve will send. A short note explains the mismatch error explicitly so the next operator who hits it knows where to look.

Same callback URL applies to Slack and GitHub OAuth flows that share the /oauth/callback path.

Test plan

• Visit /settings → the "OAuth callback URL Sieve will send" block appears under the public_base_url input, displaying ${public_base_url}/oauth/callback.
• With public_base_url unset, the block shows http://127.0.0.1:19816/oauth/callback (the loopback default).
• Set public_base_url to https://sieve.example.com and save → reload settings → block shows https://sieve.example.com/oauth/callback.
• Click-and-drag the code block → entire URL is select-all'd (no whitespace trim issues).

🤖 Generated with Claude Code

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[murbard]

@codex

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 789cf15afd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[murbard]

Closing as already-shipped / obsolete.

This change already landed on main verbatim — the callback-URL surfacing was incorporated during the IAM branch work:

• internal/web/server.go — "OAuthCallbackURL": s.publicBaseURL(r) + "/oauth/callback" is present in the settings data map (with the same rationale comment).
• internal/web/templates/settings.html — the "OAuth callback URL Sieve will send" block (with the redirect_uri_mismatch note and the select-all code element rendering {{.OAuthCallbackURL}}) is present.

The PR shows CONFLICTING precisely because it re-adds lines that now exist on main. It also branched from a pre-IAM main, so its server.go still imports the removed internal/policies package and the old policies/roles page wiring — rebasing would reintroduce code that no longer compiles, purely to re-add a feature that's already there.

No action needed; the feature is live. Deleting the stale branch.