Remove OAuth and environment configuration footguns

[MPIsaac-Per]

Problem

PORT is configurable, but the OAuth redirect URI is hard-coded to http://localhost:3979/oauth/callback. OAuth requires the redirect URI used for authorization and token exchange to match the registered URI. The initial flow also requires a placeholder LINEAR_ACCESS_TOKEN, even though OAuth replaces it.

Official docs: https://linear.app/developers/oauth-2-0-authentication.md

Proposed change

• Add OAUTH_REDIRECT_URI configuration.
• Validate obvious port/URI inconsistencies.
• Explicitly load .env in development.
• Permit startup without a bootstrap access token when authorization has not completed.

Acceptance criteria

• Authorization and token exchange use the same configured redirect URI.
• Non-default local ports work when configured correctly.
• npm run dev explicitly loads .env.
• A fresh installation can boot and print its authorization URL without a fake token.
• Existing installations remain backward compatible or receive a clear migration error.

---

Linear execution plan

GitHub remains the public source of truth. Private prioritization, dependencies, and agent execution are tracked in the Linear Agent Bridge OSS project.

Parent: MPI-1428

• MPI-1429 — Make the OAuth redirect URI configurable and remove the placeholder token requirement
• MPI-1430 — Load .env explicitly in development and document configuration migration

Implementation tickets are labeled agent-ready in Linear and include scope, acceptance criteria, dependencies, repository constraints, and required verification evidence. Public decisions and completion status should be mirrored back to this issue.

[MPIsaac-Per]

Both footguns in this issue bit during a live host migration on 2026-08-19. Concrete evidence, in case it helps prioritise.

The hardcoded redirect URI. The Linear app's redirect is http://localhost:3979/oauth/callback. Authorizing a remote host therefore means the callback has to reach that host's loopback, so the operator has to stop the local service to free the port, open ssh -L 3979:127.0.0.1:3979 <host>, then open the authorization URL in a browser on the machine holding the tunnel. That works, but it makes remote deployment awkward in a way nothing warns you about, and it has to be repeated on every re-authorization.

The placeholder token requirement. LINEAR_ACCESS_TOKEN is required so the service can boot before first authorization, after which the rotating pair in the OAuth store supersedes it and the env value is never read again. A stale value therefore sits in .env looking authoritative. Ours returned 401 when tested by hand, which is expected and says nothing about the running service, but it is exactly the sort of thing someone debugs against for twenty minutes. It now reads unused-see-oauth-token-store, which is a workaround rather than a fix.

Neither blocks anything. Both cost time, and both would be avoided by the change this issue proposes.