feat: redirect back to intended route after login

[kushalshah5-code]

Closes #523

What

Signed-out users who open a deep link (like a shared route) get sent to /login, but after logging in they always landed on / instead of where they were going. This sends them back to the original route.

How

• New src/api/auth/redirect.ts with saveRedirect(), popRedirect() (read + clear), and isSafeInternalPath().
• Dashboard.tsx: save the current path before redirecting to /login when not signed in.
• auth.tsx: changed navigate('/') to navigate(popRedirect() ?? '/') after the token exchange.
• storage.ts: added the postLoginRedirect key to the key union and a removeItem helper.

Why not the OAuth state param

The issue links the Auth0 state-param doc. I looked at using it, but the redirect_uri for all 3 providers points at the comma API (/v2/auth/{g,a,h}/redirect/), which then redirects to /auth?code=&provider=. So the destination goes through the comma backend, not straight back from the provider, and I don't think a state value survives that unless the backend forwards it. Is that something the backend does?

For now I store the destination client-side, which works regardless. popRedirect() only allows internal paths (rejects //host, /\host, and absolute URLs) so a malicious login link can't redirect someone off-site after they log in. It's cleared on read so an old destination can't carry over to a later login.

Happy to switch to state if the backend supports it.

Testing

Added a unit test for the path guard and an integration test that checks the destination is saved when you hit a protected route signed out.

Couldn't run the browser tests locally (I'm on Ubuntu 26.04 and the pinned Playwright doesn't support it yet), so I ran check/build/lines/bundle-size locally and left the browser tests to CI. Bundle goes up ~0.46KB gzipped.

[github-actions]

Changes:

path	lines	diff
./App.browser.test.tsx	57	+17
./api/auth/redirect.ts	13	+13
./pages/dashboard/Dashboard.tsx	194	+6
./utils/storage.ts	19	+3
./pages/auth/auth.tsx	55	+1

Total lines: 4778 (+40)

[github-actions]

deployed preview: https://628.connect-d5y.pages.dev

Welcome to connect! Make sure to:

• read the contributing guidelines
• mark your PR as a draft until it's ready to review
• post the preview on Discord; feedback from users will speedup the PR review

Mobile

Desktop

[kushalshah5-code]

Heads up on the red check: the only failing test is geocode.spec.ts > getFullAddress > normal usage, which hits a live geocoding API and asserts a hardcoded address. It's getting "131 Fleet Street / EC4A 2BH" back instead of the expected "133 Fleet Street / EC4A 2BB" - looks like the upstream map data changed. It's unrelated to this PR (I didn't touch geocode), and it fails on master too. My added tests in App.browser.test.tsx pass in CI. Didn't want to touch the geocode assertion since that's out of scope here.