fix: OIDC callback sent wrong scheme in token exchange redirect_uri

Fastify only sees plain HTTP -- TLS terminates at NPM/Cloudflare
before reaching this process. Building the callback's currentUrl from
req.headers.host with a hardcoded "http://" sent
redirect_uri=http://monitor.jerodrigged.com/... during the token
exchange, which Authentik rejects (logged as generic "invalid_client"
to the client, but its own event log said plainly: "Invalid redirect
URI used by provider"). Fixed by reusing the known-correct
redirectUri's origin and only taking the query string from the actual
request, instead of trying to infer scheme from headers.

Also fixes the Playwright OIDC test's selectors (Authentik's password
field has no <label> association -- placeholder text, not getByLabel).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

e2e/tests/oidc-login.spec.ts

@@ -20,7 +20,9 @@ test("OIDC login via Authentik stays on public domains throughout", async ({ pag
   await page.getByPlaceholder(/email or username/i).fill(USERNAME);
   await page.getByRole("button", { name: /log in|continue|next/i }).click();
 
-  await page.getByLabel(/password/i).fill(PASSWORD);
+  // Authentik's password field has no <label> association -- it's identified
+  // by placeholder text ("Please enter your password"), not an a11y label.
+  await page.getByPlaceholder(/password/i).fill(PASSWORD);
   await page.getByRole("button", { name: /log in|continue|sign in/i }).click();
 
   await page.waitForURL(/^https:\/\/monitor\.jerodrigged\.com\//, { timeout: 15_000 });