feat: support loopback redirect for desktop OAuth + auto-allow users

[mabrur-h]

• /auth now accepts a callback query param; after GitHub OAuth the token is appended to that URL so the desktop app can capture it via a 127.0.0.1 listener (RFC 8252) instead of a custom protocol.
• Use net/url to merge ?token= into the callback so existing query params (e.g. state for CSRF) are preserved.
• Auto-add freshly authenticated GitHub users to allowed-users.csv so desktop sign-ins work without manual invites.
• Reload the allow-list every 5s instead of every minute so newly added users can tunnel almost immediately after sign-in.