docs(ci): drop a wrong claim about OAuth callback URLs

The example said GitHub rejects wildcard callback URLs and that one app
therefore cannot serve every pr<id> host, so an operator had to re-point the
callback at whichever preview was being signed into. That is not true of this
application: a preview deployed today was signed into without anyone touching
the callback.

It now states what an operator has to arrange — a callback covering
pr<id>.api.<zone> — without asserting anything about what GitHub does or does
not accept, which is the part that was wrong and the part this file has no need
to describe.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017VKWqbmrPJFv8aKZBp36uD

Author: FelixTJDietrich

.changeset/preview-oauth-note.md

@@ -0,0 +1,4 @@
+---
+---
+
+Corrects a comment in the preview environment example; no deployed behaviour changes.

docker/preview/.env.example

@@ -20,9 +20,9 @@ HEPHAESTUS_AUTH_BOOTSTRAP_ADMINS=
 # Optional. Overrides the application server's direct-memory ceiling.
 #APP_MAX_DIRECT_MEMORY=128M
 
-# Optional preview-only GitHub OAuth app. GitHub rejects wildcard callback URLs, so one app cannot
-# serve every pr<id> host at once: either re-point its callback at the preview you are signing into,
-# or leave these blank and reach the preview as a bootstrap admin.
+# Optional preview-only GitHub OAuth app. Its callback has to cover this application's API hosts,
+# shaped pr<id>.api.<preview zone> — the preview builds its redirect_uri from the host it is served
+# on. Leave these blank to reach the preview as a bootstrap admin instead.
 GH_OAUTH_CLIENT_ID=
 GH_OAUTH_CLIENT_SECRET=