feat: remember original URL and redirect after login (#18308)

## Summary

- Implement a return-to-path mechanism that preserves the user's
intended destination across authentication flows (login, magic link,
cross-domain redirects)
- Uses layered persistence: Jotai atom (in-memory), sessionStorage with
TTL (tab-switch resilience), URL query parameter (cross-domain
propagation)
- Includes path validation to prevent open redirects, automatic cleanup
after successful login, and comprehensive test coverage
- Replaces the unused `previousUrlState` with a robust
`returnToPathState` system

## Test plan

- [ ] Visit a deep link (e.g. `/objects/tasks`) while logged out —
should redirect to login, then back to `/objects/tasks` after logging in
- [ ] Visit an OAuth authorize link while logged out — should redirect
to login, then to the authorize page
- [ ] Test magic link flow: click sign-in link that opens new tab —
should still redirect to original destination
- [ ] Test cross-domain: visit `app.twenty.com/objects/tasks` — should
preserve path through workspace domain redirect
- [ ] Verify auth/onboarding paths are excluded from being saved as
return paths
- [ ] Verify return-to-path is cleared after successful navigation
- [ ] All 215 existing `usePageChangeEffectNavigateLocation` tests pass


Made with [Cursor](https://cursor.com)

packages/twenty-front/src/modules/auth/utils/isValidReturnToPath.ts

@@ -0,0 +1,24 @@
+import { ONBOARDING_PATHS } from '@/auth/constants/OnboardingPaths';
+import { ONGOING_USER_CREATION_PATHS } from '@/auth/constants/OngoingUserCreationPaths';
+import { isNonEmptyString } from '@sniptt/guards';
+import { AppPath } from 'twenty-shared/types';
+
+const extractPathPrefix = (appPath: string): string => appPath.split('/:')[0];
+
+const EXCLUDED_PATH_PREFIXES = [
+  ...ONGOING_USER_CREATION_PATHS,
+  ...ONBOARDING_PATHS,
+  AppPath.ResetPassword,
+].map(extractPathPrefix);
+
+export const isValidReturnToPath = (path: string): boolean => {
+  if (!isNonEmptyString(path) || path === '/') {
+    return false;
+  }
+
+  if (!path.startsWith('/') || path.startsWith('//')) {
+    return false;
+  }
+
+  return !EXCLUDED_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+};