fix(login): close ?next= control-char open-redirect + cover register

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/routes/login/+page.svelte

@@ -2,6 +2,7 @@
     import { goto } from '$app/navigation';
     import { login } from '$lib/api/auth';
     import { session } from '$lib/session.svelte';
+    import { safeNext } from '$lib/safeNext';
 
     let username = $state('');
     let password = $state('');
@@ -15,7 +16,10 @@
         try {
             const user = await login({ username, password });
             session.setUser(user);
-            await goto('/');
+            // Return the user to the page they were bounced from (?next=),
+            // guarded against open redirects; default to the site root.
+            const next = new URLSearchParams(window.location.search).get('next');
+            await goto(safeNext(next));
         } catch (e) {
             error = (e as Error).message;
         } finally {

frontend/src/routes/register/+page.svelte

@@ -4,6 +4,7 @@
     import { register } from '$lib/api/auth';
     import { authConfig } from '$lib/auth-config.svelte';
     import { session } from '$lib/session.svelte';
+    import { safeNext } from '$lib/safeNext';
 
     let username = $state('');
     let password = $state('');
@@ -24,7 +25,10 @@
         try {
             const user = await register({ username, password });
             session.setUser(user);
-            await goto('/');
+            // Honour ?next= the same way login does (registration logs the
+            // user in), guarded against open redirects.
+            const next = new URLSearchParams(window.location.search).get('next');
+            await goto(safeNext(next));
         } catch (e) {
             error = (e as Error).message;
         } finally {