fix: trust deployed Vercel preview hosts

[devhims]

Problem / Motivation

Google sign-in from PR #67's Vercel preview fails before reaching Google. Production trusts preview hosts beginning with all-things-youtube-web, but the deployed Vercel project uses video2ctx-web and the devhims-projects team suffix.

Why it matters

Every real Vercel preview receives 403 Invalid callbackURL, so the OAuth proxy cannot be tested or used before merge.

What changed

The approved host pattern is now video2ctx-web-*-devhims-projects.vercel.app. This matches the real project and team while continuing to reject unrelated Vercel applications.

The Workers integration fixture now uses the exact PR #67 deployment hostname.

Tests

• Before the configuration change, the exact preview hostname reproduced 403 Invalid callbackURL.
• After the change, the same request returned 200 with the fixed production Google callback and encrypted proxy state.
• An unrelated Vercel origin still returned 403.
• All 6 Workers auth integration tests passed.
• All 3 auth configuration tests passed.
• Platform TypeScript build passed.

Manual verification

Merge this PR and wait for the production Worker deployment. Then retry Google sign-in from the PR #67 preview.

Screenshots / video

Not applicable. This changes the server-side callback allowlist without changing rendered UI.

Issue link

no linked issue: fixes preview authentication discovered while testing PR #67.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
video2ctx-web	Ready	Preview	Sep 21, 2026 12:44pm UTC

[devhims]

Intent: Allow only the actual video2ctx Vercel project previews to complete the production OAuth proxy flow.
Not a goal: Trust all Vercel deployments, change Google credentials, or modify the preview UI.