AUTH-005: return users to protected route after sign-in

[daliu]

Summary

• preserve pathname, query, and hash when account/admin guards redirect to login
• return successful sign-ins to the requested route, defaulting to /account
• reject absolute, protocol-relative, backslash, control-character, malformed, encoded, and dot-segment-normalized unsafe targets
• cover the real AdminGuard → login → authenticated-route round trip

Verification

• CI=true npx -y node@20 ... react-scripts test src/pages/login/LoginForm.test.jsx --watchAll=false --runInBand — 15/15 pass
• Node 20 production compile — pass
• changed-file ESLint — 0 errors; 6 pre-existing warnings
• Functions lint + tests under Node 20 — 2 suites / 7 tests pass
• Firestore emulator rules under Node 20 — 4 suites / 97 tests pass
• independent review by two agents — approved after normalization/query-hash findings were fixed

Known baseline

The repository-wide frontend run still fails in unchanged App.test.jsx before executing its test because TextEncoder is absent from the current setupTests.js. Another agent is already changing those overlapping harness files; #96 neither changes nor worsens that baseline.

Closes #96

[netlify]

❌ Deploy Preview for luminous-fox-7c393f failed.

Name	Link
🔨 Latest commit	1b5b5df
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a53f98d9ebc9300082052a5