Codex 收尾官：把已寫好的改動整理成語意化 commit + 一份能過審的 PR

STEP 2 — Proposed commit fix(login): return user to original page after auth instead of /dashboard Logged-out users hitting a protected page were always bounced to /dashboard after login, losing their place. Capture the original path in a signed, httpOnly return_to cookie and restore it post-auth, validating it's a same-origin relative path to avoid open redirects. Refs #482 [awaiting approval before committing] STEP 3 — PR description (base: main) ## What Redirect users back to the page they originally requested after logging in. ## Why Protected-page visitors lost context (#482); always landing on /dashboard hurt the watchlist/portfolio flows. ## How Signed return_to cookie set in middleware.ts; validated + consumed in app/login/route.ts. Falls back to /dashboard when absent or invalid. ## Testing `npx tsc --noEmit` passed; added __tests__/login-redirect.test.ts (3 cases incl. open-redirect attempt) — `npm test` green. ## Risk / rollback Low; revert this commit to restore prior behavior. Open-redirect guarded by same-origin check. ## Out of scope Does not change the OAuth provider flow or session expiry.