fix(auth): validate /auth/callback next param against open-redirect (D3)

next was appended to origin unvalidated; next=//evil.com or /\evil.com
redirected off-site post-login. Now only a same-origin absolute path
(single leading slash, no //, no /\) is honored, else /dashboard.

app/auth/callback/route.ts

@@ -1,10 +1,21 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 
+// Only a same-origin absolute path is an allowed post-login target.
+// Rejects open-redirect vectors: protocol-relative (//evil.com),
+// backslash tricks (/\evil.com), and any scheme/host.
+function safeNext(raw: string | null): string {
+  const fallback = '/dashboard'
+  if (!raw || !raw.startsWith('/') || raw.startsWith('//') || raw.startsWith('/\\')) {
+    return fallback
+  }
+  return raw
+}
+
 export async function GET(request: Request) {
   const { searchParams, origin } = new URL(request.url)
   const code = searchParams.get('code')
-  const next = searchParams.get('next') ?? '/dashboard'
+  const next = safeNext(searchParams.get('next'))
 
   if (code) {
     const supabase = await createClient()