fix(mcp): validate oauth callback port range