Add loopback-safe /heicode/oauth authorize/session endpoints for desktop browser login and wire routing/deployment overrides so local source builds include the new auth bridge.
