Harden OIDC callback redirect handoff against open redirects

[Copilot]

The OIDC callback flow could preserve an absolute external next URL at the final handoff step, creating an open-redirect sink after successful authentication. This change re-validates the stored redirect target at the redirect sink and adds a regression test for hostile absolute URLs.

• Redirect sink hardening

  • Re-sanitize transaction.next inside the callback handoff before constructing the final destination URL.
  • Ensures absolute external URLs cannot bypass earlier validation if untrusted state reaches the sink.

  const destination = new URL(safeRelativePath(next), appOrigin).toString();

• Regression coverage

  • Add a focused unit test for a stored redirect target like https://evil.example.test/phish.
  • Verifies the handoff falls back to a same-origin path instead of preserving the attacker-controlled origin.