Allow loopback fetches in portal OAuth initiate

Compliance portal OAuth must call the configured Probo base URL
during connect flows; in local dev that endpoint is loopback and
was blocked by default SSRF protection on the initiate HTTP client.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/complianceportal/v1/oauth_initiate_handler.go

@@ -45,9 +45,11 @@ func NewOAuthInitiateHandler(
 		proboBaseURL: proboBaseURL,
 		visitor:      visitorSvc,
 		safeRedirect: saferedirect.New(allowedHost),
+		// proboBaseURL is server config, not user input — loopback is expected in dev.
 		httpClient: httpclient.DefaultClient(
 			httpclient.WithLogger(logger),
 			httpclient.WithSSRFProtection(),
+			httpclient.WithSSRFAllowLoopback(),
 		),
 		logger: logger,
 	}