OAuthProxyProvider(allowed_client_redirect_uris=None) allows ALL redirect URIs

Description

In `fastmcp/server/auth/redirect_validation.py:50`, when `allowed_patterns is None` the function returns `True` unconditionally. The documentation states 'If None (default), only localhost redirect URIs are allowed.' The code directly contradicts the documented behavior.

Reproduction

# Source: redirect_validation.py:50
if allowed_patterns is None:
    return True  # 'for DCR compatibility' — but docs say localhost-only