Mars OAuth redirect_to bypasses resolveSiteOrigin() + 3 uncanonicalized prod hosts (TERRA-20-derived)

TERRA-20-derived finding (2026-08-16): 3 non-canonical hosts serve live Mars prod (bare + 2 suffixed .vercel.app aliases), no redirects. OAuth login (login-button.tsx, login-client.tsx) builds redirect_to from window.location.origin instead of resolveSiteOrigin() -- bypasses the site-origin validator. Verified via GoTrue redirect differential: currently a SILENT FALLBACK (aliases collapse to Site URL, no session ever minted on wrong host) not live exposure -- but fails invisibly and goes live if an alias is ever allow-listed or Site URL changes. Fix sequence (audit-reviewed): (1) 308 redirect bare alias -> canonical [BLOCKED on Elazar, prod config write, PATCH ready]; two suffixed hosts need a separate mechanism, not a per-domain redirect. (2) route both login call sites through a shared canonicalCallbackUrl() helper, Class-A audit-approved design, PARKED until (1) lands and is verified (wrong order breaks in-flight PKCE logins). Recorded in mars-unverifiable-state.md: Supabase redirect allow-list membership-testing done (not allow-listed); enumeration still needs a PAT.