[ObedChibunna]

Use only the validated returnTo parameter across middleware, admin guards, and the auth form. Preserve the full path and query string when redirecting after login, and remove all production of next.

CLOSES #1993

Summary

Use only the validated returnTo parameter across middleware, admin guards, and the auth form. Preserve the full path and query string when redirecting after login, and remove all production of next.

Contracts checklist

If this PR touches anything under contracts/, confirm it against the
pre-deployment security checklist before
requesting review:

• make audit (CT-72 require_auth() coverage) passes.
• Every amount-handling path uses checked arithmetic (CT-73) — no raw
  +/- on amounts.
• Not applicable — this PR does not touch contracts/.

Test plan

Frontend CI checks passed.
Backend build, lint, dependency checks, critical audit, and unit tests passed.
Database-backed checks and Rust build checks remain unverified locally: PostgreSQL was unavailable, and the pinned Rust installation ran out of disk space.

Verified frontend lint, unit tests, typecheck, build, and E2E. Backend build, unit tests (714 passed), lint, dependency checks, and critical audit passed. Database checks and Rust builds remain unverified: PostgreSQL was unavailable, and installing the pinned Rust toolchain ran out of disk space.

CLOSES #1993

[vercel]

@ObedChibunna is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@ObedChibunna Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits