fetchWithTimeout redirect trust pin

Trap: validating only the initial OAuth refresh URL, or re-reading mutable active auth during redirects, can remove the original trust anchor while stale credentials, refresh-token bodies, or IAP/custom headers remain eligible for forwarding. Fix: pin trust to the original OAuth credential origin, follow redirects manually, and validate every destination before sending headers or a body. Reject cross-origin redirects, then rebuild headers and apply normal 301/302/303 method/body conversion. Never forward credentials across an unvalidated origin.