Document redirect URI matching rules and the loopback port exception (#2680)
* Document redirect URI matching rules and the loopback port exception
The OAuth authorization endpoint now accepts any port for http loopback
redirect URIs (RFC 8252 ยง7.3 / OAuth 2.1), so native apps, CLIs and MCP
clients can register a port-less http://localhost/callback and bind an
ephemeral port at request time. Everything else still requires an exact
match.
* Apply suggestion from @coyotte508
---------
Co-authored-by: huggingface-doc-bot <doc-bot@huggingface.co>