Allow HTTP OIDC callbacks on localhost subdomains

Allow exact registered HTTP callback URIs on localhost and valid DNS subdomains ending in .localhost (including http://app.localhost:3000/devise/auth/zitadel/callback), while keeping arbitrary HTTP hosts, misleading suffixes, malformed hosts, wildcards, fragments and userinfo rejected. Update both Rust and SQL validation, including the legacy management-function guard, through a new migration without rewriting applied migrations. Preserve the existing uncommitted OIDC endpoint work. Add unit and direct-runtime-SQL regressions and verify the native registration flow; update hints and callback policy docs. Do not broaden issuer/cookie-origin or external email-delivery policy. Verified outcome: reproduced rejection with a failing Rust unit test, then allowed valid localhost subdomains in Rust and new migration 0015. The migration replaces the conservative SQL helper and consolidates the management function onto that same validator, preserving authorization, versions, history/outbox and existing grants. Original applied migrations are unchanged. Exact callback spelling is preserved; misleading suffixes, malformed labels, invalid ports, wildcards, fragments and userinfo remain rejected in both Rust and direct runtime SQL tests. Native registration browser coverage now uses the user's exact app.localhost callback. Updated localized hints and callback/migration docs; existing uncommitted OIDC endpoint work is preserved. Validation passed: cargo fmt --check, strict workspace/all-target/all-feature Clippy, cargo test --workspace --all-features, python3 dev/run.py test, python3 dev/run.py browser-test (including registration in light/dark and JS on/off plus OIDC interoperability), git diff --check. Development migration 0015 was applied by the browser gate; restart the user's development server to ensure the updated Rust binary and schema are both loaded. Changes remain uncommitted.