Refactor authentication redirection logic

- Introduce a new `auth-redirect` module to manage safe return paths for login and redirection.
- Update the login page to utilize `readReturnToFromLocation` for redirecting users post-login.
- Modify the `AuthGate` component to use `loginPathWithReturnTo` for redirecting unauthorized users, enhancing security and user experience.
- Adjust API request handling to incorporate the new redirection logic, ensuring users are directed to the appropriate login page with return paths.

frontend/src/lib/auth-redirect.ts

@@ -0,0 +1,21 @@
+/** Internal path safe to use as a post-login redirect target. */
+export function getSafeReturnTo(
+  value: string | null | undefined,
+): string | null {
+  if (!value) return null;
+  if (!value.startsWith("/") || value.startsWith("//")) return null;
+  if (value === "/login" || value.startsWith("/login?")) return null;
+  return value;
+}
+
+export function loginPathWithReturnTo(returnTo: string): string {
+  const safe = getSafeReturnTo(returnTo);
+  if (!safe) return "/login";
+  return `/login?returnTo=${encodeURIComponent(safe)}`;
+}
+
+export function readReturnToFromLocation(): string {
+  if (typeof window === "undefined") return "/";
+  const params = new URLSearchParams(window.location.search);
+  return getSafeReturnTo(params.get("returnTo")) ?? "/";
+}