fix(plaidlogin): align callback bind and redirect hosts to 127.0.0.1

On systems where localhost resolves exclusively to ::1, the browser
redirected to [::1]:PORT while the server only listened on 127.0.0.1,
causing a silent 'connection refused' that left Wait() blocking for
5 minutes before PLAID_DASHBOARD_LOGIN_TIMEOUT with no diagnostic.

RedirectHost is now 127.0.0.1 (matching BindHost) so the URI Plaid
receives and the listener address are always consistent.

Update tests that asserted the old localhost redirect URI.

Author: thedavidweng

internal/plaidlogin/login_test.go

@@ -56,7 +56,7 @@ func TestRunLoginWritesFetchedKeysAndDashboardAuth(t *testing.T) {
 	if result.KeysWritten != 2 || result.CredentialAction != "written" || result.TeamID != "team_1" {
 		t.Fatalf("result = %#v", result)
 	}
-	if callbackURL != "http://localhost:49152/oauth/callback" {
+	if callbackURL != "http://127.0.0.1:49152/oauth/callback" {
 		t.Fatalf("redirect_uri = %q", callbackURL)
 	}
 	envContent, err := os.ReadFile(envPath)

internal/plaidlogin/oauth.go

@@ -13,7 +13,7 @@ const (
 	TokenURL     = "https://api.dashboard.plaid.com/oauth/token"
 	ClientID     = "plaid-cli"
 	BindHost     = "127.0.0.1"
-	RedirectHost = "localhost"
+	RedirectHost = "127.0.0.1"
 
 	// Plaid Dashboard APIs are private; this contract was last verified against this Plaid CLI build.
 	PlaidCLICompatibilityVersion = "20260507-4d1b0ca0"

internal/plaidlogin/oauth_test.go

@@ -23,7 +23,7 @@ func TestBuildAuthURLUsesPlaidCLICompatiblePKCE(t *testing.T) {
 	}
 	values := parsed.Query()
 	assertQuery(t, values, "client_id", "plaid-cli")
-	assertQuery(t, values, "redirect_uri", "http://localhost:49152/oauth/callback")
+	assertQuery(t, values, "redirect_uri", "http://127.0.0.1:49152/oauth/callback")
 	assertQuery(t, values, "response_type", "code")
 	assertQuery(t, values, "state", "state-123")
 	assertQuery(t, values, "code_challenge_method", "S256")
@@ -32,11 +32,11 @@ func TestBuildAuthURLUsesPlaidCLICompatiblePKCE(t *testing.T) {
 	}
 }
 
-func TestBindAndRedirectHostsAreIntentionallyDifferent(t *testing.T) {
+func TestBindAndRedirectHostsMatch(t *testing.T) {
 	if BindHost != "127.0.0.1" {
 		t.Fatalf("BindHost = %q", BindHost)
 	}
-	if RedirectHost != "localhost" {
+	if RedirectHost != "127.0.0.1" {
 		t.Fatalf("RedirectHost = %q", RedirectHost)
 	}
 }

internal/plaidlogin/token_test.go

@@ -21,7 +21,7 @@ func TestExchangeCodeUsesPKCEFormBody(t *testing.T) {
 		}
 		assertForm(t, r.PostForm, "grant_type", "authorization_code")
 		assertForm(t, r.PostForm, "code", "auth-code")
-		assertForm(t, r.PostForm, "redirect_uri", "http://localhost:49152/oauth/callback")
+		assertForm(t, r.PostForm, "redirect_uri", "http://127.0.0.1:49152/oauth/callback")
 		assertForm(t, r.PostForm, "client_id", ClientID)
 		assertForm(t, r.PostForm, "code_verifier", "verifier")
 		json.NewEncoder(w).Encode(map[string]any{