fix(test): allow the manual-entry guard in the OAuth loopback source assertion

#9944 added an explicit manual-entry bypass to the isLocalhost arm of
PKCE_CALLBACK_SERVER_PROVIDERS, so the condition now reads
`isLocalhost && !opts?.manualLoopback` instead of a bare `isLocalhost`.
oauth-lan-loopback-guidance.test.ts pinned the literal shape of that guard
with a source regex, so it went red on the release tip the moment #9944
landed, even though the behaviour it guards is intact: the arm still calls
buildPkceLoopbackMismatchHint and still renders the structured panel.

Widen the regex to tolerate extra guard conditions while keeping the
assertion it actually makes. Verified by mutation: replacing the
buildPkceLoopbackMismatchHint call with a generic setError still fails the
test with the same message, so this does not weaken the contract.

Refs #9944

tests/unit/oauth-lan-loopback-guidance.test.ts

@@ -101,9 +101,15 @@ test("the flat warning string is still exported for non-UI callers", () => {
 test("OAuthModal renders the structured panel instead of the generic error step", () => {
   const modal = readSrc("shared/components/OAuthModal.tsx");
 
+  // #9944 added an explicit manual-entry bypass to this arm, so the condition is
+  // no longer a bare `isLocalhost` — it reads `isLocalhost && !opts?.manualLoopback`
+  // (choosing "Enter URL manually" skips the warning for that one attempt). The
+  // contract being asserted is unchanged: the isLocalhost arm must still build the
+  // structured hint rather than fall through to the generic red error step. Only the
+  // literal shape of the guard is allowed to vary.
   assert.match(
     modal,
-    /else if \(isLocalhost\) \{[\s\S]{0,300}buildPkceLoopbackMismatchHint/,
+    /else if \(isLocalhost[^)]*\) \{[\s\S]{0,300}buildPkceLoopbackMismatchHint/,
     "the isLocalhost arm of PKCE_CALLBACK_SERVER_PROVIDERS must build the structured hint"
   );
   assert.match(