Per https://jackhenry.dev/open-api-docs/plugins/architecture/externalapplications/:
"The redirect URI that handles the initial authentication flow for your plugin must appear first in the Redirect URI list since Banno’s Dashboard UI expects to call the first redirect URI to render the plugin’s card face."
I think that's why you are seeing the OAuth flow working fine outside of Banno, but not seeing the OAuth flow working as you would expect for a plugin card inside of Banno.
Meaning, you have http://localhost:3030/cnx/auth-start?tid=75b94b7e-e60d-4cb6-bbac-e85949b4ca0e defined first then http://localhost:3030/cnx/oauth2?tid=75b94b7e-e60d-4cb6-bbac-e85949b4ca0e defined second, but per your question above you said you started the auth flow with the second defined redirect URI, when you really want to start the auth flow with that first defined redirect URI for the plugin's card face.