Single-shot, dependency-free OAuth loopback callback interaction.

The listener binds an ephemeral port on one configured loopback IP literal. It accepts only an HTTP/1.1 origin-form GET for the exact callback path with one exact Host header and no request body. The socket is passive and owned by the foreground caller; callback parameters never enter another process, Logger, Telemetry, or command-line arguments.

The pending authorization's deadline is absolute. An interaction that has already expired accepts no connection and reads no bytes, including bytes the socket has already buffered, so a client cannot complete or extend an authorization after its deadline. Expiry at any point reports :authorization_timeout; only malformed input or a socket failure reports :invalid_callback_request.