[MCP Portals] Document OAuth callback URLs

[sha-e-512]

Summary

• Document the dashboard callback URL
• Clarify which callback URLs need to be added to the upstream OAuth provider's redirect URI allowlist
• Specify when each callback URL is used; to summarize:

1. DCR w/o shared callback @ registration-time: dashboard callback URL
2. DCR w/ shared callback @ registration-time: dashboard callback URL
3. DCR w/o shared callback @ connection-time: portal-scoped callback URL
4. DCR w/ shared callback @ connection-time: shared callback URL
5. Manual: shared callback URL, always

Documentation checklist

• The change adheres to the documentation style guide.

[cloudflare-docs-bot]

AI Review

✅ Reviewed d6701dc · 0 findings · incremental

Resolved (1) · Dismissed (0)

• Resolved: Semicolon joins two independent clauses · Verified at head via read_repo_file: line 242 reads "...before authorizing the upstream MCP server. Otherwise, authorization may fail." The semicolon was replaced with a period, splitting the independent clauses into two sentences as the core-content rule requires.

Commands

• /review Run a review now.
• /full-review Review the entire PR diff.
• /disable-auto-review Stop automatic reviews.
• /rebase Rebase against production.