[everpcpc]

Summary

• add static OAuth callback relay pages for AniList, MyAnimeList, Bangumi, and MangaBaka
• validate provider-specific instance callback URLs before forwarding authorization codes and state
• add scoped Cloudflare security headers and document the new public routes

Validation

• temporary Node contract assertions for all providers, valid callbacks, malformed input, and unsafe targets
• pnpm typecheck && pnpm build && pnpm exec nimbus-docs check && pnpm lint:docs
• checked all documented routes and relay assets in dist
• wrangler deploy --dry-run and local HTTP security-header checks
• browser-tested successful forwarding and wrong-provider rejection

Out of scope

• production deployment
• OAuth provider application registration
• kmrs/komf-rs relay URL adoption