OAuth redirect URI hardcoded to localhost:8085, doesn't account for --instance/--port-base

[dblanchard]

document_cognition_service's OAuth callback (used by the MCP client
connector flow under Settings > MCP integrations) is registered with
FusionAuth via a hardcoded http://localhost:8085/oauth/redirect in
kickstart.rs, rather than being derived from the instance's port-base.

Under a named instance (--instance macro-dev --port-base 31000),
document_cognition_service's actual host port is 31014
(docker ps confirms 0.0.0.0:31014->8080/tcp), but the OAuth redirect
registered with FusionAuth stays fixed at 8085. Result: any provider that
completes a real OAuth round-trip (e.g. Grafana Cloud) reaches a genuine
consent screen, approves successfully on Grafana's side, but fails at the
callback with invalid_request / "Failed to approve authorization request".
Linear's connector fails even more directly with a browser-level connection
refusal to localhost:8085, since nothing in this instance binds that port.

Repro:

• just run_local --no-doppler --instance macro-dev --port-base 31000
• Settings > MCP integrations > Connect on Grafana -> real consent screen ->
  Allow access -> invalid_request
• Connect on Linear -> Firefox can't connect to localhost:8085

Relevant code:

• tooling/xtask/crates/xtask_local/src/local/kickstart.rs:75 -
  "http://localhost:8085/oauth/redirect" (hardcoded)
• tooling/xtask/crates/xtask_local/src/local/instance.rs:88 -
  DocCognition = 8085 (also fixed, not instance-derived)

[synoet]

Great catch! I will fix