test/origins-security-provider.test.ts: the off-host redirect test cannot connect to its own `localhost` origin #585

Found while admitting test/[d-o]*.test.ts to the gate (#562). a redirect off-host is refused and the far host sees nothing serves an origin on hostname localhost and expects error invalid_response; here the client answers unreachable ("Unable to connect") in ~70 ms, before any redirect is seen — localhost resolution and Bun.serve binding disagree on this machine. The other 18 tests in the file pass. Make the test bind and dial the same address (127.0.0.1 and 127.0.0.2, say) so the redirect is actually exercised. Part of #261.

Parked by the crew: the run ended without a pull: declined: Issue #585 is already fixed on this branch's base, so I made no change and pushed nothing. Commit 8acb523 ("The off-host redirect test binds and dials one address, and joins the gate") makes the `a

Parked by the crew: the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #990 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the run ended without a pull: declined: Issue #585 is already fixed on this branch's base, so I made no change and pushed nothing. Commit 8acb523 ("The off-host redirect test binds and dials one address, and joins the gate") makes the `a
2. the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #990 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Dropped: done on main. Commit 8acb523 ("The off-host redirect test binds and dials one address, and joins the gate") is what this asked for, and test/origins-security-provider.test.ts is in GATE. The second run's red check was test/capacity.test.ts, which #1047 takes out of the gate.