security: harden loopback OAuth callback and require token for API listeners

[martin-forge]

Problem

An empty API token currently permits unauthenticated requests. The OAuth callback also searches for a free port before binding it and inserts callback error text into its HTML response.

Solution

Generate and save a strong token before starting the API/MCP listener, and reject requests when no token is configured. Let the OS allocate the OAuth port, register the callback before opening the browser, accept each pending callback once, and return fixed HTML with restrictive headers. Follow-up to the loopback protection in #1923.

Testing

• Focused API/CORS, OAuth callback, credential storage and revocation tests pass.
• npm run lint and npm run build:test pass.
• Reloaded the standalone build in a disposable Obsidian vault; no captured errors.
• GitHub CI: full test suite and build passed.