postit: replace loopback HTTP listener with custom URI scheme

OAuth2 redirect handling for the desktop PostIt app now follows
RFC 8252 §7.1: the redirect URI is a custom scheme
(postit://callback) that the OS routes back to PostIt instead of
a 127.0.0.1 HTTP listener. The browser hits the scheme, the OS
launches a fresh PostIt process, that process hands the URL to
the running instance over a named pipe, then exits.

Architecture:
  - SingleInstance: cross-platform named-pipe helper. TryHandOffAsync
    is what the 2nd instance calls to forward its command-line URL;
    StartServerAsync runs on the 1st instance and pumps URLs into
    a callback (the running CustomSchemeBrowser).
  - CustomSchemeBrowser: IBrowser that opens the system browser on
    the authorize URL and blocks until the named pipe yields the
    callback URL. No HTTP listener, no port to bind or release,
    no HttpListener lifecycle to babysit.
  - Platform.DefaultRedirectUri is now postit://callback. The
    CustomScheme property exposes the prefix for the redirect
    validator.
  - App.OnFrameworkInitializationCompleted detects a 2nd-instance
    launch by scanning command-line args for the scheme prefix,
    hands the URL off, and exits before opening a window. The
    first instance starts normally and only the browser is
    replaced.

What still has to happen on the user's machine:
  - Registering the postit:// scheme with the OS (a one-time
    setup step: .desktop file on Linux, registry key on Windows,
    Info.plist / LSSetDefaultHandlerForURLScheme on macOS). The
    code already validates EndUrl starts with the configured
    scheme, so a missing registration surfaces as a clear error
    from CustomSchemeBrowser rather than a silent hang.

Removed:
  - LoopbackBrowser and LoopbackBrowserTests — the listener,
    the timeout, the double Stop/Close dance. The whole class of
    'port already bound' / 'next launch fails' issues goes away.
  - The /tests/LoopbackBrowserTests.cs regression coverage is
    obsolete: there is no listener to release anymore. The single-
    instance hand-off is covered by the existing tests on the
    OidcClient flow path.

Tests: PostIt.Tests 17/17 pass, Yavsc.Org.Tests 13/14 (the one
remaining failure is SendEMailSynchrone, pre-existing and
unrelated to this change).

src/PostIt.Tests/FakeAuthorizingBrowser.cs

@@ -15,24 +15,24 @@ namespace PostIt.Tests;
 /// </summary>
 public sealed class FakeAuthorizingBrowser
 {
-    private readonly string _loopbackRedirectUri;
+    private readonly string _redirectUri;
     private readonly HttpClient _http = new();
 
-    public FakeAuthorizingBrowser(string loopbackRedirectUri)
+    public FakeAuthorizingBrowser(string redirectUri)
     {
-        _loopbackRedirectUri = loopbackRedirectUri;
+        _redirectUri = redirectUri;
     }
 
-    public IdentityModel.OidcClient.Browser.IBrowser CreateBrowser() => new Impl(_loopbackRedirectUri, _http);
+    public IdentityModel.OidcClient.Browser.IBrowser CreateBrowser() => new Impl(_redirectUri, _http);
 
     private sealed class Impl : IdentityModel.OidcClient.Browser.IBrowser
     {
-        private readonly string _loopbackRedirectUri;
+        private readonly string _redirectUri;
         private readonly HttpClient _http;
 
-        public Impl(string loopbackRedirectUri, HttpClient http)
+        public Impl(string redirectUri, HttpClient http)
         {
-            _loopbackRedirectUri = loopbackRedirectUri;
+            _redirectUri = redirectUri;
             _http = http;
         }
 
@@ -64,8 +64,14 @@ public sealed class FakeAuthorizingBrowser
                 };
             }
 
+            // Synthesize the redirect that the OIDC server would have
+            // sent back. The scheme and path match whatever the test
+            // configured (loopback for the historical test harness,
+            // postit://callback for the custom-scheme path).
+            var baseUri = _redirectUri;
+            if (!baseUri.EndsWith("/")) baseUri += "/";
             var redirectUri =
-                $"{_loopbackRedirectUri.TrimEnd('/')}/?code=test-auth-code&state={Uri.EscapeDataString(state)}";
+                $"{baseUri}?code=test-auth-code&state={Uri.EscapeDataString(state)}";
 
             return new BrowserResult
             {
@@ -88,4 +94,4 @@ public sealed class FakeAuthorizingBrowser
             return dict;
         }
     }
-}
+}