fix: migrate to tailwind v4 and TS6, add oauth2 dashboard_host setting

- migrate Tailwind v3->v4 (postcss @tailwindcss/postcss, CSS-first @theme/@plugin/@custom-variant)
- fix TS6 build: ignoreDeprecations for baseUrl, react-day-picker v10 classNames, test type fixes
- add dashboard_host setting field with i18n

src/locales/en/translation.json

@@ -141,6 +141,8 @@
     "WAF": "Web Application Firewall",
     "SiteName": "Site Name",
     "DashboardOriginalHost": "Agent connecting address [domain name/IP:port]",
+    "DashboardHost": "Dashboard host for OAuth2 callback [domain name/IP:port]",
+    "DashboardHostHint": "The dashboard's public host used to build the OAuth2 callback URL. Set this when the dashboard is reached on a different domain than the agent connecting address. Leave empty to trust the request Host as-is.",
     "ReservedHosts": "Reserved hosts (comma-separated; public/reverse-proxy domains members cannot use as NAT domains)",
     "ReservedHostsHint": "Behind a reverse proxy the dashboard cannot see its own public domain, so it is not auto-protected. List every public entry hostname here, or a member could register it as a NAT domain and hijack dashboard routing.",
     "ConfigTLS": "Use TLS to connect Agent",