feat(setup): switch default tunnel to ngrok

[ryanshepps]

Summary

• Switch the default self-hosted tunnel connector from Cloudflare Tunnel to ngrok.
• Update gordie init to detect ngrok, offer Homebrew installation when missing, configure the authtoken, and briefly start ngrok to discover the account dev-domain URL.
• Keep the tunnel provider isolated to setup/compose/docs so it stays easy to replace later.
• Tighten OAuth base URL validation so setup/runtime reject localhost and private IPs, not just plain HTTP.
• Refresh setup docs and .env.example around ngrok authtokens, stable dev domains, and the Docker connector target.

Test Coverage

All new setup paths have focused unit coverage:

• Missing ngrok with install declined falls back to manual URL/authtoken prompts.
• Existing ngrok can configure an authtoken, discover a dev-domain URL, and write .env.
• Docker Compose runs the default ngrok connector with NGROK_AUTHTOKEN.
• OAuth base URL validation rejects plain HTTP and localhost URLs.

Pre-Landing Review

No remaining issues found. One validation gap found during review, https://localhost being accepted as "public HTTPS", was fixed before push.

Design Review

No frontend files changed.

Eval Results

No prompt-related files changed.

Greptile Review

Greptile comment fetch was unavailable due a GitHub API connectivity error during review.

Plan Completion

No plan file detected.

Verification Results

• uv run ruff check scripts/setup.py server/oauth_config.py server/oauth_link_service.py server/routes/oauth_routes.py tools/oauth/generate_oauth_link.py tests/unit/test_setup_cli.py tests/unit/test_oauth_link_service.py tests/unit/test_generate_oauth_link_tool.py
• uv run basedpyright scripts/setup.py server/oauth_config.py server/oauth_link_service.py tools/oauth/generate_oauth_link.py tests/unit/test_setup_cli.py tests/unit/test_oauth_link_service.py tests/unit/test_generate_oauth_link_tool.py
• uv run pytest tests/unit/test_setup_cli.py tests/unit/test_oauth_link_service.py tests/unit/test_generate_oauth_link_tool.py
• docker compose config --services
• uv run gordie init --help
• git diff --check
• Commit hook: full ruff, basedpyright, and pytest suite: 336 passed, 1 warning

TODOS

No TODOS.md file exists in this repository.

Test plan

• Focused setup/OAuth tests pass
• Type checking passes
• Linting passes
• Docker Compose config validates
• Full test suite passes