fix: wait for auth callback server readiness

[krowvin]

Summary

• wait until the local OIDC callback server has bound its socket before the test connects
• use an OS-assigned port so parallel or local processes cannot collide with a fixed test port
• keep the production callback implementation unchanged

Failure addressed

This fixes the intermittent Python 3.9 failure observed in workflow run 31043633835, job 92433739624.

The test started the callback server on a background thread and immediately attempted to connect. On the failed runner, the client won that race and received ConnectionRefusedError: [Errno 111] Connection refused before the server had bound and begun listening. The same test passed in the Python 3.12 job and in other runs, confirming this was a timing-dependent test failure rather than a regression in PR #247.

Validation

• targeted test passed 25 consecutive runs with zero failures
• full local suite: 232 passed
• pre-commit: all hooks passed
• local GitHub Actions fork with act, Ubuntu and Python 3.9.25: smoke test passed and 232 tests passed

The local workflow fork replaced only the Poetry setup action with pip install poetry because act did not propagate that action's PATH update; the repository workflow itself is unchanged.