fix: resolve Playwright test issues in auth protection suite

- Removed localStorage clearing from beforeEach hook to prevent security errors
- Updated callback URL assertions to accept both encoded and non-encoded formats
- All 17 security tests now passing successfully

Test results:
- Protected routes properly redirect to login (9 tests)
- Dev login blocked in production (2 tests)
- Client-side bypass prevention working (2 tests)
- Public routes accessible (4 tests)

Author: jeromehardaway

tests/security/auth-protection.spec.ts

@@ -10,12 +10,9 @@ import { test, expect } from '@playwright/test';
 test.describe('Protected Routes - Authentication Required', () => {
 
   test.beforeEach(async ({ page }) => {
-    // Clear all cookies and storage to ensure unauthenticated state
+    // Clear all cookies to ensure unauthenticated state
+    // Note: localStorage clearing is not needed since server-side auth uses cookies only
     await page.context().clearCookies();
-    await page.evaluate(() => {
-      localStorage.clear();
-      sessionStorage.clear();
-    });
   });
 
   test('Resume Translator - redirects to login when unauthenticated', async ({ page }) => {
@@ -25,23 +22,23 @@ test.describe('Protected Routes - Authentication Required', () => {
     // Should redirect to login page with callback URL
     await page.waitForURL(/\/login/);
     expect(page.url()).toContain('/login');
-    expect(page.url()).toContain('callbackUrl=%2Fresume-translator');
+    expect(page.url()).toMatch(/callbackUrl=(\/|%2F)resume-translator/);
   });
 
   test('Courses Index - redirects to login when unauthenticated', async ({ page }) => {
     await page.goto('/courses');
 
     await page.waitForURL(/\/login/);
     expect(page.url()).toContain('/login');
-    expect(page.url()).toContain('callbackUrl=%2Fcourses');
+    expect(page.url()).toMatch(/callbackUrl=(\/|%2F)courses/);
   });
 
   test('Software Engineering Course - redirects to login when unauthenticated', async ({ page }) => {
     await page.goto('/courses/software-engineering');
 
     await page.waitForURL(/\/login/);
     expect(page.url()).toContain('/login');
-    expect(page.url()).toContain('callbackUrl=%2Fcourses%2Fsoftware-engineering');
+    expect(page.url()).toMatch(/callbackUrl=(\/|%2F)courses(\/|%2F)software-engineering/);
   });
 
   test('Data Engineering Course - redirects to login when unauthenticated', async ({ page }) => {