Decouple OAuth2 callback host from agent install host. When dashboard_host is empty, the request Host is passed through; otherwise non-reserved hosts are pinned to dashboard_host. Added to reserved-host allowlist for NAT.