#4585 Collective-registered OAuth clients can't complete authorization_code: redirect URIs are stored as a JSON array string

Found while testing #4498. Part of #4459.

Problem

registerClient (lib/infrastructure/oauth-queries.ts) stores a client's redirect URIs as JSON.stringify(redirectUris), which is a JSON array string such as ["https://a.example/cb"]. better-auth reads redirectUrls as a comma-separated list. So the authorize step compares the request's redirect URI against ["https://a.example/cb"] with its brackets and quotes, and refuses it.

As a result, no client registered through a collective can complete the authorization_code flow. Nothing uses that flow today, since swamp serve signs in with the device grant, but the first thing that does will fail. The #4498 session confirmed this locally by patching the stored row.

Fix

• Store redirect URIs in the format better-auth reads.
• Migrate existing oauthApplication rows whose redirectUrls hold a JSON array string.
• Refuse a redirect URI containing a comma at registration, since the stored format can't hold one.

Done when

• A collective-registered client with one redirect URI, and one with two, both complete authorization_code end to end.
• Existing rows are migrated, and a test covers a row in the old format.