fix(oauth): use directory-based routing for extension OAuth callbacks

Go's http.FileServer doesn't automatically map /path to /path.html.
Move callback.html files to callback/index.html directory structure
so /oauth/callback and /oauth/ff/callback routes work correctly.