fix: add OAUTH_REDIRECT_ALLOWLIST for client registration and waive the open default (SEC-05)

.env.example

@@ -34,6 +34,11 @@ GITEA_OAUTH_CLIENT_SECRET=
 # Encrypts stored user tokens. At least 32 characters. Generate with:
 # openssl rand -hex 32
 TOKEN_ENCRYPTION_KEY=
+# Optional allowlist of redirect URIs clients may register (comma separated): exact
+# URIs, or https://host/ prefixes. Empty accepts any https URI (and http on
+# loopback); the consent page is then the only check. For a public deployment list the
+# hosted clients you use, e.g. https://claude.ai/,https://chat.mistral.ai/
+OAUTH_REDIRECT_ALLOWLIST=
 # Granular Gitea scopes only (read:/write: activitypub, admin, issue, misc,
 # notification, organization, package, repository, user). Unknown values are rejected.
 OAUTH_SCOPES=write:activitypub,write:admin,write:issue,write:misc,write:notification,write:organization,write:package,write:repository,write:user