OAuth redirects on custom domains

Implementation order

1. Assign an owner.
2. Separate preview and production.
3. Configure the smallest safe baseline.
4. Test expected and failure paths.
5. Document evidence and rollback.

Evidence standard

A builder-generated screen or successful demo is not proof. Verify the deployed configuration, a real non-admin user flow, alerts and recovery behavior.