fix: harden OAuth callbacks and packaged notifications

[lyyzka]

Summary

• validate OAuth return URLs by parsed scheme, hostname, effective port, credentials, and path boundaries
• bind mobile OAuth callbacks to a cryptographically random, expiring, single-use nonce
• load the packaged Electron notification renderer through app://lingxiloop
• add regression coverage for URL spoofing, nonce mismatch/expiry/replay, and the notification URL

Validation

• npm test (291 passed)
• npm run lint
• npm run typecheck
• npm run server:typecheck
• npm run build

Closes #70
Closes #71
Closes #72