fix default callback base URL port mismatch

Derive CALLBACK_BASE_URL fallback from LISTEN_ADDR so default local setup resolves to localhost:8080 and stays aligned with server bind port.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/config/config.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"fmt"
+	"net"
 	"os"
 	"strings"
 
@@ -77,7 +78,7 @@ func Load() (*Config, error) {
 		cfg.ListenAddr = ":8080"
 	}
 	if cfg.CallbackBaseURL == "" {
-		cfg.CallbackBaseURL = "http://localhost"
+		cfg.CallbackBaseURL = defaultCallbackBaseURL(cfg.ListenAddr)
 	}
 
 	if err := cfg.validate(); err != nil {
@@ -87,6 +88,17 @@ func Load() (*Config, error) {
 	return cfg, nil
 }
 
+func defaultCallbackBaseURL(listenAddr string) string {
+	host, port, err := net.SplitHostPort(listenAddr)
+	if err != nil || port == "" {
+		return "http://localhost:8080"
+	}
+	if host == "" || host == "0.0.0.0" || host == "::" {
+		host = "localhost"
+	}
+	return fmt.Sprintf("http://%s:%s", host, port)
+}
+
 // validate checks that all required configuration values are present.
 func (c *Config) validate() error {
 	required := map[string]string{

internal/config/config_test.go

@@ -30,8 +30,23 @@ func TestLoad_DefaultCallbackBaseURL_WhenUnset(t *testing.T) {
 		t.Fatalf("load config: %v", err)
 	}
 
-	if cfg.CallbackBaseURL != "http://localhost" {
-		t.Fatalf("expected default callback base URL http://localhost, got %q", cfg.CallbackBaseURL)
+	if cfg.CallbackBaseURL != "http://localhost:8080" {
+		t.Fatalf("expected default callback base URL http://localhost:8080, got %q", cfg.CallbackBaseURL)
+	}
+}
+
+func TestLoad_DefaultCallbackBaseURL_UsesListenPort(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("CALLBACK_BASE_URL", "")
+	t.Setenv("LISTEN_ADDR", ":9090")
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load config: %v", err)
+	}
+
+	if cfg.CallbackBaseURL != "http://localhost:9090" {
+		t.Fatalf("expected callback base URL to follow LISTEN_ADDR port, got %q", cfg.CallbackBaseURL)
 	}
 }