oidc: serve the registration confirmation page from a reloadable URL

[kradalby]

Interactive OIDC login failed whenever anything reloaded the confirmation page — Adblock Plus calling window.location.reload(), the back button, pull-to-refresh — because renderRegistrationConfirmInterstitial wrote it as the body of /oidc/callback, the URL carrying the single-use code. One deployment measured completion falling from 100% to 61-73%.

The callback now 303-redirects to GET /register/confirm/{auth_id}, which was missing from the route table and answered a bare 405; the confirm cookie moves to SameSite=Lax to survive that redirect and is still required to render the page, so knowing the auth ID is not enough to confirm a registration.

Dropped from the original branch: the Sec-Fetch-Site: same-origin → 204 short-circuit, redundant once nothing is parked on the callback and fatal when the IdP shares headscale's origin.

Fixes #3365

Generated with the help of an AI assistant

[kradalby]

The build check is red on a blocker that is not this PR's, and it gates the whole integration matrix (all sqlite/postgres jobs show as skipping).

Dockerfile.tailscale-HEAD:7 pins golang:1.27.0-alpine and then clones tailscale HEAD, whose go.mod now requires go >= 1.27.1:

#14 0.080 go: go.mod requires go >= 1.27.1 (running go 1.27.0; GOTOOLCHAIN=local)
ERROR: failed to solve: process "/bin/sh -c GOARCH=$TARGETARCH go install ..." exit code: 1

This same check passed on this exact tree earlier today — the last push changed only commit message text, not a byte of code (git diff between the two heads is empty). Nothing in the diff touches Dockerfile.tailscale-HEAD, and the failure is deterministic, so a re-run will not clear it. Every PR in the repo will hit it until the pin moves.

Proposed patch, same shape as docker: head tailscale latest go:

-FROM golang:1.27.0-alpine AS build-env
+FROM golang:1.27.1-alpine AS build-env

Verified locally: docker build -f Dockerfile.tailscale-HEAD . fails on the current pin and succeeds with 1.27.1-alpine. Leaving it out of this PR rather than widening it — happy to port it here or send it separately.