fix: Use 127.0.0.1 for OAuth per RFC 8252 and improve reliability

- Updated OAuth URLs from localhost to 127.0.0.1 (RFC 8252 requirement)
- Changed login page to use window.location.href for proper server redirects
- Added client-metadata.json for ATproto OAuth compliance
- Improved Step 2 theme test to check overall theme instead of specific details

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

public/client-metadata.json

@@ -0,0 +1,14 @@
+{
+  "client_id": "http://127.0.0.1:3000/client-metadata.json",
+  "client_name": "Ponderants",
+  "client_uri": "http://127.0.0.1:3000",
+  "redirect_uris": [
+    "http://127.0.0.1:3000/api/auth/callback"
+  ],
+  "scope": "atproto",
+  "grant_types": ["authorization_code", "refresh_token"],
+  "response_types": ["code"],
+  "application_type": "web",
+  "token_endpoint_auth_method": "none",
+  "dpop_bound_access_tokens": true
+}