fix: initiate OAuth flow from callback route for correct redirect_uri

src/components/pages/grain-oauth-callback.js

···
 import { LitElement, html, css } from 'lit';
+import { auth } from '../../services/auth.js';
 import '../atoms/grain-spinner.js';
 
 export class GrainOAuthCallback extends LitElement {
···
       font-size: var(--font-size-sm);
     }
   `;
+
+  async connectedCallback() {
+    super.connectedCallback();
+    const params = new URLSearchParams(window.location.search);
+    if (params.get('start') === '1') {
+      window.history.replaceState({}, '', '/oauth/callback');
+      await auth.startOAuthFromCallback();
+    }
+  }
 
   render() {
     return html`

src/services/auth.js

···
 
   async login(handle) {
     sessionStorage.setItem('oauth_return_url', window.location.pathname);
-    await this.#client.loginWithRedirect({
-      handle,
-      redirectUri: `${window.location.origin}/oauth/callback`
-    });
+    sessionStorage.setItem('oauth_handle', handle);
+    window.location.href = '/oauth/callback?start=1';
+  }
+
+  async startOAuthFromCallback() {
+    const handle = sessionStorage.getItem('oauth_handle');
+    sessionStorage.removeItem('oauth_handle');
+    if (!handle) {
+      router.replace('/');
+      return;
+    }
+    await this.#client.loginWithRedirect({ handle });
   }
 
   logout() {