Fix review issues: redirect validation, status codes, stale comments, error wrapping

- Add isValidRedirectParam() and sanitizeRedirectSearchParam() helpers
  with reactive RedirectSanitized state for toast notification
- Extract REDIRECT_QUERY_PARAM constant and use across all call sites
- Sanitize invalid redirect params in hooks.client.ts init() using
  native browser APIs (runs before SvelteKit router init)
- Show warning toast via root layout $effect when a bad param is stripped
- Change 308 → 303 redirects in shockers and /t endpoints
- Validate redirect_uri scheme (HTTP/S only) in API token page
- Update stale comments referencing deprecated function
- Include original error message in GetBasePath error wrapping
- Add tests for new helpers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hhvrc

src/hooks.client.ts

@@ -4,8 +4,11 @@ import { backendMetadata } from '$lib/state/BackendMetadata.svelte';
 import { initializeDarkModeStore } from '$lib/stores/ColorSchemeStore.svelte';
 import { initializeSerialPortsStore } from '$lib/stores/SerialPortsStore';
 import { UserStore } from '$lib/stores/UserStore';
+import { sanitizeRedirectSearchParam } from '$lib/utils/url';
 
 export async function init() {
+  sanitizeRedirectSearchParam();
+
   initBackendMetadata().catch((error) => {
     handleApiError(error);
   });

src/lib/api/index.ts

@@ -39,7 +39,8 @@ function GetBasePath(): string {
 
     return `${url.origin}${pathname}`;
   } catch (error) {
-    throw new Error('PUBLIC_BACKEND_API_URL is not a valid URL', { cause: error });
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`PUBLIC_BACKEND_API_URL is not a valid URL: ${message}`, { cause: error });
   }
 }
 

src/lib/state/RedirectSanitized.svelte.ts

@@ -0,0 +1,14 @@
+/** Reactive flag set when {@link sanitizeRedirectSearchParam} strips a malicious redirect param. */
+let flag = $state(false);
+
+export const redirectSanitized = {
+  get value() {
+    return flag;
+  },
+  set() {
+    flag = true;
+  },
+  reset() {
+    flag = false;
+  },
+};