fix: bind OAuth credentials to trusted API bases

[arvid-berndtsson]

Summary

• Restrict OAuth token requests to approved Vanta API hosts unless a custom HTTPS host is explicitly trusted during login.
• Bind stored OAuth credentials and cached access tokens to a normalized API base, and reject destination mismatches.
• Prevent explicit credentials from reusing or persisting cached tokens; block token-request redirects and redact response bodies from errors.

Verification

• npm test: 24 passed.
• npm run typecheck passed.
• git diff --check passed.

This is separate from PR #16, which contains only the approved agent-output terminal-control sanitization.