fix(auth): fix mock responses in tests and block open redirect in login

- Add response object to mockSuccess() in login and signup tests so
  response.headers.get() no longer throws
- Validate ?redirect= param: must start with / and not // to prevent
  redirecting users to external domains

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/(public)/login/+page.server.ts

@@ -40,7 +40,8 @@ export const actions = {
 			cookies.set('JSESSIONID', sessionId, { path: '/', httpOnly: true, sameSite: 'lax' });
 		}
 
-		const redirectTo = url.searchParams.get('redirect') || '/planner';
+		const raw = url.searchParams.get('redirect');
+		const redirectTo = raw && raw.startsWith('/') && !raw.startsWith('//') ? raw : '/planner';
 		throw redirect(303, redirectTo);
 	}
 } satisfies Actions;