docs: document console origin and redirect URI prerequisites

[Bccorb]

Closes #96.

What

Documents the two allowlist prerequisites for serving the admin console, both of which currently fail partway through a flow with no hint in the docs:

• docs/configuration.md (WebAuthn ORIGINS row): the origin serving the console must be in ORIGINS, alongside the app origins.
• docs/configuration.md (Admin dashboard section): a new "Prerequisites for browser flows started from the console" block listing both requirements for both deployment shapes (served directly by this API, or reverse-proxied via createSeamlessConsoleProxy), with the searchable symptoms (passkey/step-up start fine and fail at finish; OAuth start returns 400 before any redirect).
• docs/oauth.md (Redirect Policy): the console callback shape <origin>/console/oauth/callback must be in each provider's redirectUris and registered with the identity provider, else redirect_uri_mismatch at consent.

Scope

Docs only. No code change.