fix: restore configurable redirect URI field – required when APP_URL is not set

src/components/Settings.tsx

@@ -355,6 +355,19 @@ export default function Settings({ currentUser: _currentUser }: SettingsProps) {
               onToggleShow={() => setShowAzureSecret(v => !v)}
             />
           </FieldRow>
+          <div className="sm:col-span-2">
+            <FieldRow
+              label="Redirect URI"
+              hint="Must match exactly what is registered in Azure Portal → App registrations → Authentication. Leave blank to auto-derive from APP_URL."
+            >
+              <Input
+                value={azureRedirectUri}
+                onChange={setAzureRedirectUri}
+                placeholder={effectiveRedirectUri || 'https://…/api/auth/azure/callback'}
+                monospace
+              />
+            </FieldRow>
+          </div>
           <FieldRow
             label="Allowed Group"
             hint="Object ID of an Azure AD group. If set, only members of this group can sign in."