update default redirect urls in docs and envs

CLAUDE.md

···
 ### Typical Development Workflow
 1. **Terminal 1** (Server): `cd packages/server && bun run dev`
 2. **Terminal 2** (Client): `cd packages/client && bun run dev`
-3. **Access**: Open http://localhost:5173 in browser (client proxies to server)
+3. **Access**: Open http://127.0.0.1:5173 in browser (client proxies to server)
 
 ## Architecture
 
···
 - `BASE_URL` - OAuth redirect base URL (production)
 
 **Client** (`packages/client/.env.local`):
-- `VITE_API_URL` - Server API URL (e.g., http://localhost:3000)
+- `VITE_API_URL` - Server API URL (e.g., http://localhost:4000)
 
 ## Package-Specific Documentation
 
···
    ```
 
 4. **Access the application**:
-   - Client: http://localhost:5173
-   - Server API: http://localhost:3000
-   - API Docs: http://localhost:3000/swagger
+   - Client: http://127.0.0.1:5173
+   - Server API: http://localhost:4000
+   - API Docs: http://localhost:4000/openapi
 
 ## Troubleshooting
 

README.md

···
    PORT=3000
    DATABASE_URL=./data/dev.db
    AUTH_SECRET=your-secret-key-here
-   BASE_URL=http://localhost:3000
+   BASE_URL=http://localhost:4000
    ```
 
    **Client** (`packages/client/.env.local`):
    ```env
-   VITE_API_URL=http://localhost:3000
+   VITE_API_URL=http://localhost:4000
    ```
 
 ### Development
···
 ```
 
 Then open:
-- **Frontend**: http://localhost:5173
-- **API**: http://localhost:3000
-- **API Docs**: http://localhost:3000/swagger
+- **Frontend**: http://127.0.0.1:5173
+- **API**: http://localhost:4000
+- **API Docs**: http://localhost:4000/openapi
 
 ### Alternative: Run from Root
 

packages/client/CLAUDE.md

···
 
 **Environment Configuration**:
 - `VITE_API_URL` - Server API base URL (configured in `.env.local`)
-- Development default: `http://localhost:3000`
+- Development default: `http://localhost:4000`
 - Production: Set to your deployed server URL
 
 **Making API Calls**:
···
    bun run dev
    ```
 
-3. **Access app**: Open `http://localhost:5173` in browser
+3. **Access app**: Open `http://127.0.0.1:5173` in browser
 
 ### Adding New Features
 1. Create route files in `app/routes/`

packages/client/README.md

···
 npm run dev
 ```
 
-Your application will be available at `http://localhost:5173`.
+Your application will be available at `http://127.0.0.1:5173`.
 
 ## Building for Production
 

packages/server/CLAUDE.md

···
 - `AUTH_SECRET` - Secret for cookie signing
 - `BASE_URL` - Full base URL for OAuth redirects (required in production)
 - `ALLOWED_REDIRECT_ORIGINS` - Comma-separated list of allowed client origins (required)
-  - Example: `http://localhost:5173,https://app.example.com,https://staging-app.example.com`
+  - Example: `http://127.0.0.1:5173,https://app.example.com,https://staging-app.example.com`
   - Used to validate redirect URIs and prevent open redirect vulnerabilities
   - Must use exact origin format (protocol + host + port)
   - First origin in list is used as default when redirect_uri not provided

packages/server/src/lib/redirect-validator.ts

···
   }
 }
 
-const DEFAULT_LOCAL_REDIRECT_URI = 'http://localhost:5173'
+const DEFAULT_LOCAL_REDIRECT_URI = 'http://127.0.0.1:5173'
 
 /**
  * Gets the default redirect URI for the environment