fix(shared): pin Google OAuth redirect_uri to decocms.com/deco.site allowlist

[0xcucumbersalad]

Summary

• createGoogleOAuth() (shared/google-oauth.ts) forwarded the runtime-supplied callback URL verbatim as redirect_uri to Google's authorize endpoint and token endpoint. Google delivers the auth code to that host, so an attacker-influenced origin could hijack the code/token — same vuln class fixed for github MCP in fix(github): pin OAuth redirect_uri to decocms.com allowlist #453.
• Adds shared/redirect-allowlist.ts (assertAllowedRedirectUri / isAllowedRedirectUri), allowing hosts under decocms.com or deco.site (plus their subdomains) over https, and loopback over http for local dev.
• Checked app.json across the 17 MCPs using createGoogleOAuth — most are hosted on deco.site (sites-<name>.deco.site), only google-gmail uses decocms.com, hence both suffixes are allowlisted.
• One shared fix covers all active consumers: google-docs, google-analytics, google-meet, google-tag-manager, google-apps-script, google-forms, youtube-channel-admin, google-calendar, google-big-query, google-gmail, google-sheets, google-drive, google-workspace, google-slides, google-search-console. (grafana/template-minimal have the oauth block commented out, unaffected.)

Test plan

• bun test shared/redirect-allowlist.test.ts — 9 pass (canonical origins, subdomains, loopback dev, non-loopback http rejection, look-alike/suffix-confusion hosts, other schemes, case-insensitivity)
• bun run fmt / pre-commit lint pass
• Smoke-test an actual OAuth connect flow for one Google MCP in staging

🤖 Generated with Claude Code

---

Summary by cubic

Pins Google OAuth redirect_uri to an allowlist under *.decocms.com, *.deco.site, and *.deco.host to prevent auth code/token hijack. Previously createGoogleOAuth forwarded the callback verbatim; now both authorization URL creation and token exchange validate and reject disallowed hosts. Requires https except loopback over http; deco.host is allowed for tunnel-based local dev.

• Adds shared redirect allowlist with assertAllowedRedirectUri/isAllowedRedirectUri and tests; used by all Google-based MCPs.

Required actions

• Use https callbacks under *.deco.site, *.decocms.com, or *.deco.host. For local dev, use http://localhost/http://127.0.0.1, or an https *.deco.host tunnel.
• Update any custom-domain callbacks; disallowed hosts will throw “Refusing OAuth redirect_uri …”. Smoke-test one Google OAuth flow in staging.

^{Written for commit 848550c. Summary will update on new commits.}