fix(oauth): consent OTP email now includes the 6-digit code

When connecting an MCP client (Claude Desktop, Claude Code) via the OAuth consent screen, the sign-in email now always includes the 6-digit code alongside the magic link. Previously, the code was missing from the email because the OTP request carried no redirect URL, causing the email hook's MCP-flow detection to fail silently — users were left with an unusable code-entry screen.