fix: rewrite auth server URLs for remote deployments

[salmon-21]

Summary

When the authorization server (e.g. Dex) runs on an internal network with its issuer set to the public gateway URL, external clients receive internal URLs they cannot reach, and the gateway encounters a circular dependency fetching JWKS from itself.

This PR fixes three related issues that arise in remote/reverse-proxy deployments where authorization.server differs from host:

• Authorization redirect: rewrites the redirect URL to use the public host instead of the internal auth server address
• Discovery metadata: adds rewriteMetadataURLs() to rewrite all URL fields in the /.well-known/oauth-authorization-server response from internal to public
• JWKS circular dependency: extracts the path from the advertised jwks_uri and prepends the internal authorization.server address, so the gateway fetches keys directly from the auth server instead of from itself
• Auth server endpoint proxy: when authorizationProxyEnabled is set, reverse-proxies auth server endpoints (token, keys, userinfo, etc.) derived from the metadata so external clients can reach them through the public gateway URL

Example scenario

host: https://public-gateway.example.com/
authorization:
  server: http://dex:5556/  # internal, not reachable from outside
  authorizationProxyEnabled: true

Without this fix, external clients receive URLs like http://dex:5556/token in the discovery metadata and cannot complete the OAuth flow.

Test plan

• Unit tests for authServerProxyPaths() (5 cases: standard extraction, deduplication, empty metadata, invalid values, prefix patterns)
• go build ./... passes
• Manually tested full OAuth flow (DCR → authorization → GitHub login → callback → token exchange → authenticated MCP access) with Dex issuer set to public gateway URL

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR improves OAuth behavior when the authorization server is only reachable on an internal network but advertises public URLs (typical reverse-proxy / remote deployment setup). It aims to ensure external clients receive reachable gateway URLs while the gateway itself can still talk directly to the internal auth server (notably for JWKS).

Changes:

• Rewrites the authorization redirect URL to use the configured public host.
• Rewrites discovery metadata URL fields from internal auth-server URLs to public gateway URLs.
• Adds reverse-proxying for auth-server endpoints (token/jwks/userinfo/etc.) derived from metadata, and avoids JWKS self-fetch circular dependencies by using the internal auth server address.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
oauth/oauth.go	Builds internal JWKS fetch URL and registers reverse-proxy routes derived from auth-server metadata; adds authServerProxyPaths.
oauth/authorization_server_metadata.go	Rewrites metadata URL fields from internal auth-server URLs to the public host.
oauth/authorization.go	Rewrites the authorization redirect to use the public host.
oauth/oauth_test.go	Adds unit tests for authServerProxyPaths().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.