[ToniAdreal]

Problem

Fixes #7068.

Some providers return long, session-bound authorization codes that exceed 2048 characters. The /oauth/callback endpoint rejects those with 422 Unprocessable Entity from FastAPI query validation — before the handler ever runs — so users can't complete the OAuth flow and there's no way to reach the handler's real validation.

Repro (verified locally)

Using FastAPI TestClient with get_db overridden against the callback endpoint:

• 3000-char code + invalid state with current code → 422 (FastAPI rejects it; handler never runs)
• Same request with max_length=4096 → 400 "Invalid OAuth state parameter." (reaches the handler, which correctly reports the bad state)
• Reverting the change → 422 again

This isolates the 2048 cap as the sole cause of the 422.

Change

One line in mcpgateway/routers/oauth_router.py:

- code: Annotated[str | None, Query(max_length=2048, ...)] = None,
+ code: Annotated[str | None, Query(max_length=4096, ...)] = None,

No DB migration needed (query param only). This also aligns with the existing precedent in this repo: routers/sso.py already uses max_length=4096 for the SSO callback's authorization code.

Risk

Minimal — only widens a length cap; downstream token exchange and HMAC state verification still do the real validation.