Add App__Domain config to derive connect redirect URI

Let deployments set a single App__Domain (e.g. sptb.example.com) instead of
spelling out the full ClientConnect__RedirectUri. The SharePoint-connect
callback is derived as <domain>/connect/callback; an explicit RedirectUri
still wins for back-compat.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Program.cs

@@ -172,6 +172,21 @@ builder.Services.AddHttpClient("oauth");
 // ── ClientConnect options ─────────────────────────────────────────────────────
 builder.Services.Configure<ClientConnectOptions>(builder.Configuration.GetSection("ClientConnect"));
 
+// Derive the SharePoint-connect redirect URI from the app's public domain (App__Domain)
+// when ClientConnect__RedirectUri isn't set explicitly. Lets a deployment configure a
+// single domain (e.g. sptb.example.com) instead of spelling out the full callback URL.
+// An explicit RedirectUri still wins, so existing configs are unaffected.
+var appDomain = new AppDomainOptions();
+builder.Configuration.GetSection("App").Bind(appDomain);
+builder.Services.PostConfigure<ClientConnectOptions>(opts =>
+{
+    if (string.IsNullOrWhiteSpace(opts.RedirectUri) &&
+        appDomain.BuildUrl("/connect/callback") is { } callback)
+    {
+        opts.RedirectUri = callback;
+    }
+});
+
 // ── App config ────────────────────────────────────────────────────────────────
 var certsFolder = Path.Combine(dataFolder, "appcerts");
 builder.Services.Configure<AppConfiguration>(opt =>