fix: Use 127.0.0.1 for OAuth per RFC 8252 and improve reliability

- Updated OAuth URLs from localhost to 127.0.0.1 (RFC 8252 requirement)
- Changed login page to use window.location.href for proper server redirects
- Added client-metadata.json for ATproto OAuth compliance
- Improved Step 2 theme test to check overall theme instead of specific details

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.example.env

@@ -14,9 +14,9 @@ GOOGLE_AI_API_KEY=your-google-ai-api-key
 # Deepgram API Key (for voice-to-text)
 DEEPGRAM_API_KEY=your-deepgram-api-key
 
-# Bluesky/ATproto OAuth Configuration
-BLUESKY_CLIENT_ID=http://localhost:3000/client-metadata.json
-BLUESKY_REDIRECT_URI=http://localhost:3000/api/auth/callback
+# Bluesky/ATproto OAuth Configuration (use 127.0.0.1 per RFC 8252)
+BLUESKY_CLIENT_ID=http://127.0.0.1:3000/client-metadata.json
+BLUESKY_REDIRECT_URI=http://127.0.0.1:3000/api/auth/callback
 
 # Test Account Credentials (for E2E tests)
 TEST_BLUESKY_HANDLE=your-test-bluesky-handle