fix(auth): runtime allowlist return_to с private для LAN SSO

Co-authored-by: Cursor <[email protected]>

apps/web/src/components/portal-login-form.tsx

@@ -17,16 +17,11 @@ import {
   AlertDescription,
   AlertTitle,
 } from '@/components/reui/alert'
-import { setToken } from '@/lib/auth'
+import { ensureReturnToAllowlist, setToken } from '@/lib/auth'
 import { ApiError } from '@/lib/api-client'
 import { login, meQueryKey } from '@/queries/auth'
 import { AuthLogo } from '@/components/blocks/auth-18/components/auth-logo'
 
-/** Dev default matches auth-portal .env.example; prod should pass via Vite if needed. */
-const RETURN_TO_ALLOWLIST =
-  import.meta.env.VITE_RETURN_TO_ALLOWLIST ??
-  '.shnt.top,localhost,http://localhost:5173'
-
 export function PortalLoginForm() {
   const navigate = useNavigate()
   const queryClient = useQueryClient()
@@ -48,10 +43,8 @@ export function PortalLoginForm() {
       setToken(res.access_token)
       queryClient.setQueryData(meQueryKey, res.user)
 
-      if (
-        returnTo &&
-        isReturnToAllowed(returnTo, RETURN_TO_ALLOWLIST)
-      ) {
+      const allowlist = await ensureReturnToAllowlist()
+      if (returnTo && isReturnToAllowed(returnTo, allowlist)) {
         window.location.href = buildSsoRedirectUrl(
           returnTo,
           res.access_token,