The Fly.io deployment guide told users to register
<BASE_URL>/api/oauth/<provider>/callback, but OmniRoute's browser OAuth
flow (OAuthModal.startOAuthFlow) uses a single <BASE_URL>/callback handler
— there is no per-provider callback route. The mismatch made GitLab Duo
(and every OAuth provider) reject the flow with 'The redirect URI included
is not valid'. Fix the doc to the real /callback path and add a guard test.
Refs #3732
