fix(auth): восстанавливать раздел и фильтры после входа Portal

lib/auth-return-path.ts

@@ -0,0 +1,22 @@
+/** Accept an application path, never an external URL or another auth handoff. */
+export function safeAuthReturnPath(value: string | null | undefined): string | null {
+  if (!value || value.length > 2048 || !value.startsWith("/") || value.startsWith("//")) return null
+  if (/[\\\u0000-\u0020\u007f]/.test(value)) return null
+  try {
+    const url = new URL(value, "https://mmapp.invalid")
+    if (url.origin !== "https://mmapp.invalid" || /%/.test(url.pathname)) return null
+    if (/^\/(auth|api|access-denied)(\/|$)/.test(url.pathname)) return null
+    return url.pathname + url.search
+  } catch {
+    return null
+  }
+}
+
+export function permittedAuthReturnPath(
+  value: string | null | undefined,
+  allowed: (pathname: string) => boolean,
+  fallback: string,
+): string {
+  const path = safeAuthReturnPath(value)
+  return path && allowed(new URL(path, "https://mmapp.invalid").pathname) ? path : fallback
+}