fix(auth): verify external identity providers during handoff

[michaelbrusegard]

Webmail sign-in with Pocket ID completes in the browser, but the native app rejects the handoff with Sign-in response token endpoint is not trusted when the IdP is on a separate host. For example, webmail.example.com and mail.example.com do not authorize id.example.com. QR pairing uses the same check.

This adds a fallback for providers configured by the selected webmail:

• Fetch /api/config and /api/auth/oauth/metadata from that webmail over HTTPS, without sending the returned tokens.
• Require exact matches for the JMAP server, client ID, configured issuer and discovered token endpoint.
• Reject failed discovery, redirects, missing final response URLs and non-HTTPS external endpoints. Each metadata request has an 8-second timeout.

The existing host-based allowance and password flow are unchanged; this does not broadly trust sibling domains or change server discovery. The client-certificate transport still fails closed for external-IdP verification because its response does not expose the final URL.

Verification

• New call-site tests reproduce four failures on upstream main: external and sibling-host providers in both handoff and pairing. All 56 regression cases pass with the patch, including endpoint substitution, metadata mismatches, redirects, timeouts and callback-state rejection.
• Full suite: 1,028 passed, 14 skipped. TypeScript check passed.
• Android JavaScript/Hermes bundle export passed.

Not tested on an Android device or emulator. The browser and network transports are mocked in the regression tests. Real Pocket ID login and subsequent token refresh still need device verification; the bundle export is not an APK or end-to-end test.

---

Generated by gpt-6-astra in Paseo using the Pi harness.

[michaelbrusegard]

Let me know if you need anything from me to get this fix merged :)