Magic link redirect target is tenant wide, so web and mobile cannot both receive links #141

Context

Magic link URLs are built from a single tenant wide value:

const frontendUrl = config.frontend_url ?? config.origins[0];

That works when a tenant has one frontend. It does not work when the same tenant has a
web app and a mobile app, because a link has to land in one or the other. A mobile client
needs a universal link or an app scheme, and a web client needs the web URL.

Scope

Decide between:

• A per client redirect target, supplied when the magic link is requested and validated
  against an allowlist in the same way OAuth redirect URIs already are.
• Or documenting that the tenant serves a web landing page which bounces into a universal
  link, and leaving the API unchanged.

The second needs no API change but only works when the app is installed, and it makes the
web app a hard dependency of mobile sign in.

Notes

resolveOAuthRedirectUri is a working precedent for the first option: exact match against
a provider allowlist, falling back to origin comparison.

Untested during the mobile spike, so the effort here is less certain than the rest.