fix(auth): runtime allowlist return_to с private для LAN SSO

Co-authored-by: Cursor <[email protected]>

apps/api/src/config.ts

@@ -14,7 +14,7 @@ export const configSchema = z.object({
   adminEmail: z.string().email().default('[email protected]'),
   adminPassword: z.string().default('admin'),
   adminName: z.string().default('Admin'),
-  returnToAllowlist: z.string().default('.shnt.top,localhost'),
+  returnToAllowlist: z.string().default('.shnt.top,localhost,private'),
   serverPort: z.coerce.number().int().positive().default(8080),
   staticDir: z.string().optional(),
   logLevel: z.string().default('info'),
@@ -36,7 +36,8 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
     adminEmail: env.ADMIN_EMAIL ?? '[email protected]',
     adminPassword: env.ADMIN_PASSWORD ?? 'admin',
     adminName: env.ADMIN_NAME ?? 'Admin',
-    returnToAllowlist: env.RETURN_TO_ALLOWLIST ?? '.shnt.top,localhost',
+    returnToAllowlist:
+      env.RETURN_TO_ALLOWLIST ?? '.shnt.top,localhost,private',
     serverPort: env.SERVER_PORT ?? 8080,
     staticDir: env.STATIC_DIR || undefined,
     logLevel: env.LOG_LEVEL ?? 'info',