Cursor Agent7/1/2026, 10:41:12 PM

Phase 2 of the Bun-native migration. The callback listener drops node:http
for Bun.serve, binds 127.0.0.1 and best-effort ::1 on the same port, and
keeps the advertised redirect URI pinned to 127.0.0.1. OAuth state entropy
moves from node:crypto randomBytes to Web Crypto getRandomValues. Adds a
test covering the pinned redirect host and the ::1 listener.

Co-authored-by: Max Weinbach <mweinbach@users.noreply.github.com>

Parentc4aaada