fix(auth): sanitize login redirect paths

[rissrice2105-agent]

Summary

• add a safeRedirectPath helper for login redirect query params
• keep internal app paths while falling back external, protocol-relative, missing, or relative values to /dashboard
• add regression coverage for external redirect sanitization

Tests

• corepack pnpm --filter @pairux/shared-types build
• corepack pnpm --filter @pairux/web exec vitest run src/components/auth/LoginForm.test.tsx
• corepack pnpm --filter @pairux/web typecheck
• git diff --check