[grade=B] fix(auth): generalize cross-host SSO handoff

Codex deployment review: urn:ump:sufisot7ewy33mhjude3ly6wxcjizagt42ywaicwve6qufqdtvbq

Caddy path-order correction: urn:ump:o6apvvpvhynkouii4cl5ghxpprrwtilrg2dejdy2lqsupoktc6tq

dashcaddy-api/routes/auth/sso-gate.js

@@ -219,6 +219,18 @@ module.exports = function(deps) {
       return errorResponse(res, 401, 'Invalid or expired handoff token');
     }
     session.setCookieHostOnly(res, totpConfig.sessionDuration);
+    if (req.query.return) {
+      let returnPath = '/';
+      try {
+        const parsed = new URL(req.query.return, 'https://dashcaddy.invalid');
+        if (parsed.origin === 'https://dashcaddy.invalid') {
+          returnPath = `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        }
+      } catch (_) {
+        // Invalid or cross-origin return values fall back to the service root.
+      }
+      return res.redirect(303, returnPath);
+    }
     ok(res, { authenticated: true });
   });