fix(web): retain cloud destination on login retry

[cyncui]

why

a failed oauth state check leaves the original /cloud destination in session storage. try again started a new login with the default /app destination. closes #547.

what changed

• pass the stored destination to startLogin(), which already restricts it to /cloud or /app.
• add a component test that clicks the real retry control and checks the new state, cleared query, destination, and redirect for cloud and fallback cases.

scope

• covers retries after callback verification fails. the initial login and successful callback paths are unchanged.
• does not exercise a live oauth provider.

blast radius

only callback retry navigation changes. missing or unsupported stored destinations still use /app.

verification

• focused callback and login tests passed, 9 tests.

• the web suite passed, 137 tests, using temporary stand-ins for generated wasm files that the loader tests mock. the files were removed after the run.

• typecheck passed with a temporary declaration for the unavailable generated wasm module. chrome qa passed for cloud, missing, and unsupported destinations with an oauth endpoint stub.

• i signed off every commit (git commit -s / developer certificate of origin).

[Maxerns]

Thanks minimal and correct.

Passing the stored destination back through the existing startLogin allowlist is the right approach. It reuses the existing validation, avoids introducing another parsing path, and doesn’t open up an open-redirect risk. The hostile-destination case proves the fallback still works as intended.

I also reverted the fix locally as a regression check, and exactly the /cloud case failed. The other three tests still pass, which is a good sign that they’re pinning the existing safe behaviour rather than just the new change.

The full web suite and typecheck are both green on my side.

The branch is behind main, so it’ll need a rebase before merge, but I’m approving the content and i'll handle the rebase