fix(oauth): use getBaseUrl() in DCR so endpoints respect APP_URL behind a proxy

[oliverhees]

Problem

The Dynamic Client Registration endpoint (POST /oauth/register) builds the
authorization_endpoint / token_endpoint / userinfo_endpoint /
revocation_endpoint it returns from req.protocol + "://" + req.get("host").

Behind a reverse proxy, the backend's Host is the internal address
(e.g. localhost:12009), so registered clients receive unreachable
http://localhost:12009/oauth/* endpoints.

oauth/metadata.ts already solves this with the getBaseUrl(req) helper from
./utils, which prioritizes APP_URL and then X-Forwarded-*. As a result
.well-known/oauth-authorization-server returns the correct public URLs while
DCR returns localhost — an inconsistency between the two handlers.

Spec-compliant clients (e.g. Claude) ignore the non-standard endpoint fields in
the DCR response and use the authorization-server metadata, so they work. Clients
that trust the DCR-returned endpoints get the localhost URLs and fail.

Repro

curl -s -X POST https://<public-host>/oauth/register \
  -H "Content-Type: application/json" \
  -d '{"client_name":"probe","redirect_uris":["http://localhost:3000/callback"],"grant_types":["authorization_code"],"response_types":["code"],"token_endpoint_auth_method":"none"}'
# => "authorization_endpoint":"http://localhost:12009/oauth/authorize"  (despite APP_URL=https://<public-host>)

Fix

Use the existing getBaseUrl(req) helper in both /oauth/register handlers, so
registration is consistent with metadata.ts and respects APP_URL.