fix(auth): preserve returnUrl in local fallback login

[mpaulosky]

Summary

• preserve the validated returnUrl when placeholder Auth0 config redirects /Account/Login to /test/login
• teach the local test-login endpoint to honor the same safe relative return path
• strengthen AppHost and architecture coverage for the fallback redirect contract

Context

• follow-up to merged PR fix(auth): bypass OIDC challenge when placeholder Auth0 config is active (#396) #397

Closes #398
Working as Gandalf (Security / Auth)

[github-actions]

🏗️ PR Added to Squad Triage Queue

This PR has been labeled with squad and added to the triage queue.

Next steps:

• The squad Lead will review and assign to an appropriate team member
• A squad:member label will be added after triage

If you know which squad member should handle this, you can add the appropriate squad:member label yourself.

[Copilot]

Pull request overview

This PR refines the Development/Testing Auth0-placeholder fallback so /Account/Login preserves a validated returnUrl when redirecting to the local /test/login endpoint, and updates /test/login to redirect back to the same safe return path after setting the test auth cookie. It also adds AppHost and architecture-level coverage to lock in the redirect contract and improves AppHost test determinism by clearing Auth0 environment variables inside the spawned web resource.

Changes:

• Preserve (and forward) returnUrl when /Account/Login short-circuits to /test/login under placeholder Auth0 config.
• Teach /test/login to redirect to the same validated safe relative return path (instead of always /).
• Add AppHost + architecture contract tests; clear Auth0 env vars in AppHost fixtures for deterministic placeholder behavior; add docs troubleshooting note.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/Architecture.Tests/AuthFallbackContractTests.cs	Adds a source-order contract test ensuring placeholder short-circuit occurs before OIDC challenge.
tests/AppHost.Tests/Tests/Auth/LoginFallbackTests.cs	Adds runtime redirect assertions for /Account/Login and /test/login honoring returnUrl.
tests/AppHost.Tests/Infrastructure/ClearCommandAppFixture.cs	Clears Auth0 env vars in the spawned web resource to force placeholder behavior in Testing.
tests/AppHost.Tests/Infrastructure/AspireManager.cs	Clears Auth0 env vars (with logging) to keep AppHost tests deterministic even with ambient secrets.
src/Web/Program.cs	Preserves returnUrl through placeholder fallback and redirects /test/login back to the requested path.
docs/AUTH0_SETUP.md	Documents the IDX20803/test.auth0.com timeout pattern and the expected local fallback behavior.
.squad/agents/gimli/history.md	Records testing/coverage work and validation notes for the auth fallback coverage changes.
.squad/agents/gandalf/history.md	Reformats and records prior auth security findings and the placeholder-login approach.

[github-actions]

Test Results Summary

515 tests  +1   514 ✅ +1   32s ⏱️ ±0s
  6 suites ±0     1 💤 ±0 
  6 files   ±0     0 ❌ ±0 

Results for commit 351153a. ± Comparison against base commit 3dac6f1.

This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.

AppHost.Tests.LoginFallbackTests ‑ AccountLogin InTestingWithPlaceholderAuth0Config RedirectsToLocalTestLogin

AppHost.Tests.LoginFallbackTests ‑ AccountLogin InTestingWithPlaceholderAuth0Config RedirectsToLocalTestLoginWithReturnUrl
AppHost.Tests.LoginFallbackTests ‑ TestLogin InTestingWithReturnUrl RedirectsBackToRequestedPage

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.46%. Comparing base (3dac6f1) to head (351153a).

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #399   +/-   ##
=======================================
  Coverage   85.46%   85.46%           
=======================================
  Files          70       70           
  Lines        1693     1693           
  Branches      207      207           
=======================================
  Hits         1447     1447           
  Misses        166      166           
  Partials       80       80           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.