fix(sdk): align redirect URI validation with OpenProof server

[thecompez]

Issue

OpenProof C++ registration accepts HTTPS redirect URIs or native IP-loopback HTTP callbacks with an explicit port. The JavaScript SDK accepted remote HTTP and unsupported URI schemes, allowing misconfigured integrations that the server would later reject.

Fix

• Accept HTTPS or http://127.0.0.1:PORT / http://[::1]:PORT only.
• Reject remote HTTP, localhost alias, custom schemes not supported by the server, invalid loopback ports and ambiguous/invalid URL encodings.
• Preserve standard HTTPS and registered native loopback callback workflows.
• Add positive and negative SDK regression tests.

Validation

• New negative tests fail on unpatched code.
• JavaScript SDK tests: pass.
• OpenAPI coverage: pass.
• git diff --check: pass.

Compatibility note

This intentionally rejects custom-scheme URLs that were previously accepted by the SDK constructor but are not registerable with the current OpenProof server. Keep as draft until reviewed and CI passes.

No production deployment or restart.