fix(oauth): consent OTP email reliably includes the 6-digit code

The connector sign-in email still arrived as a plain magic link with no 6-digit code. The OTP request anchored its redirect on the consent page's origin (auth.memsprout.com), which the Supabase Auth redirect allow-list does not cover — so the redirect was rejected, fell back to the Site URL, and lost the marker the email hook uses to include the code. The OTP redirect now anchors on the app origin (memsprout.com), which is allow-listed, so the marker survives and the email always includes the code. Enter that code on the consent screen to finish connecting.