feat(oauth2): add dashboard_host setting for callback URL

Decouple OAuth2 callback host from agent install host. When dashboard_host
is empty, the request Host is passed through; otherwise non-reserved hosts
are pinned to dashboard_host. Added to reserved-host allowlist for NAT.

model/config.go

@@ -45,6 +45,11 @@ type ConfigDashboard struct {
 	InstallHost string `koanf:"install_host" json:"install_host,omitempty"`
 	AgentTLS    bool   `koanf:"tls" json:"tls,omitempty"` // 用于前端判断生成的安装命令是否启用 TLS
 
+	// DashboardHost 是 dashboard 对外访问的主机名，专用于 OAuth2 回调地址。
+	// 它与 InstallHost（agent 连接用主机名）解耦：两者可以是不同域名。
+	// 为空时，OAuth2 回调放行请求 Host（信任请求头），不做强制重写。
+	DashboardHost string `koanf:"dashboard_host" json:"dashboard_host,omitempty"`
+
 	WebRealIPHeader   string `koanf:"web_real_ip_header" json:"web_real_ip_header,omitempty"`     // 前端真实IP
 	AgentRealIPHeader string `koanf:"agent_real_ip_header" json:"agent_real_ip_header,omitempty"` // Agent真实IP
 	UserTemplate      string `koanf:"user_template" json:"user_template,omitempty"`

model/setting_api.go

@@ -8,6 +8,7 @@ type SettingForm struct {
 	SiteName                    string `json:"site_name,omitempty" minLength:"1"`
 	Language                    string `json:"language,omitempty" minLength:"2"`
 	InstallHost                 string `json:"install_host,omitempty" validate:"optional"`
+	DashboardHost               string `json:"dashboard_host,omitempty" validate:"optional"`
 	ReservedHosts               string `json:"reserved_hosts,omitempty" validate:"optional"`
 	CustomCode                  string `json:"custom_code,omitempty" validate:"optional"`
 	CustomCodeDashboard         string `json:"custom_code_dashboard,omitempty" validate:"optional"`