Fix compliance page login redirect to custom domains

SafeRedirect previously matched against a single static host string,
so OIDC callbacks always fell back to the console instead of
redirecting back to compliance pages on custom domains. Refactor
AllowedHost into a dynamic AllowedHostFunc and wire a trust-service
lookup into the connect handler so custom domain hosts are accepted.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/api.go

@@ -15,6 +15,7 @@
 package api
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"net/http"
@@ -188,6 +189,14 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.Cookie,
 			cfg.TokenSecret,
 			cfg.BaseURL,
+			func(ctx context.Context, host string) bool {
+				if host == cfg.BaseURL.Host() {
+					return true
+				}
+
+				_, err := cfg.Trust.GetByDomainName(ctx, host)
+				return err == nil
+			},
 		),
 	}, nil
 }