Preserve request body across 307/308 redirects

Clone Bytes bodies before sending so they can be resent on 307/308
Preserve redirects. For stream bodies that can't be replayed, return
an error instead of silently dropping the body. Also fix dropped_body
metadata to accurately reflect whether the body was actually dropped.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

plugins/auth-oauth2/src/index.ts

@@ -9,7 +9,6 @@ import type { Algorithm } from 'jsonwebtoken';
 import {
   buildHostedCallbackRedirectUri,
   DEFAULT_LOCALHOST_PORT,
-  HOSTED_CALLBACK_URL_BASE,
   stopActiveServer,
 } from './callbackServer';
 import {