fix: stop leaking connector OAuth session tokens to other origins

The connector OAuth popup posted the session token to window.opener with
a '*' target origin, so any page that opened the popup received it. An
attacker with an account on a multi-user deployment could start a flow for
their own pending session, get a victim to finish the provider consent, and
receive a token backed by the victim's Drive/SharePoint/Confluence tokens.

- Post popup results only to allowed frontend origins: the callback origin,
  OIDC_FRONTEND_URL, the new CONNECTOR_ALLOWED_ORIGINS, and localhost:5173
  when the callback runs on a loopback host.
- Render the success page from the callback itself so the token never
  appears in a URL; callback-status ignores session_token/user_email params.
- ConnectorAuth accepts messages only from the popup it opened, on the
  callback origin reported by /api/connectors/auth.
- /api/connectors/disconnect requires auth and only deletes the caller's
  session.
- /api/connectors/sync and /api/remote reject session tokens the caller
  does not own.

Fixes #2766

tests/test_extra_coverage.py

@@ -158,12 +158,17 @@ class TestSourcesUploadExtra:
             response = UploadRemote().post()
         assert response.status_code == 400
 
-    def test_remote_connector_triggers_task(self, app):
+    def test_remote_connector_triggers_task(self, app, pg_conn):
         from docsgpt.api.user.sources.upload import UploadRemote
+        from docsgpt.storage.db.repositories.connector_sessions import ConnectorSessionsRepository
         import json as _json
 
+        repo = ConnectorSessionsRepository(pg_conn)
+        session = repo.upsert("u", "google_drive", status="authorized")
+        repo.update(str(session["id"]), {"session_token": "st"})
+
         fake_task = MagicMock(id="conn-t")
-        with patch(
+        with _patch_upload_db(pg_conn), patch(
             "docsgpt.parser.connectors.connector_creator.ConnectorCreator"
             ".get_supported_connectors",
             return_value={"google_drive"},
@@ -210,6 +215,8 @@ class TestConnectorExtra:
             "/api/connectors/disconnect", method="POST",
             json={"provider": "x", "session_token": "y"},
         ):
+            from flask import request
+            request.decoded_token = {"sub": "u"}
             response = ConnectorDisconnect().post()
         assert response.status_code == 500