Supabase OAuth redirect_uri_mismatch: the provider console and Supabase disagree

# redirect_uri_mismatch: fix it in the provider console

This error is issued by Google, GitHub, or whichever provider you use, before Supabase is even involved. Editing Supabase's Redirect URLs does nothing for it. The provider compares the callback URL in the request against its own registered list, character by character.

## Symptom to cause to confirmation to fix

1. Read the error source. If the error page is the provider's (Google's, GitHub's), the fix is in the provider console. If it is Supabase's or your app's, it is the Supabase allowlist instead.
2. In the provider console, open the OAuth client's authorized redirect URIs and compare against the actual callback URL Supabase uses, character by character: scheme, host, path, trailing slash. A missing trailing slash is enough to fail.
3. Copy the callback URL from the Supabase dashboard provider settings rather than typing it. Typos in the project ref are the most common mismatch.
4. Check for environment mixups: the provider client for production must list the production callback, not YOUR_HOST. Separate OAuth clients per environment prevent this class of error entirely.
5. After changing the provider console, test in incognito. Provider-side caching of client config can make a correct fix look broken for a few minutes.

## Verification

Complete the flow in incognito with a fresh provider account. Success means the exact strings now agree. Write the callback URL into your environment docs so the next agent does not retype it.