fix(auth): follow server redirect after passkey sign-in

packages/auth/assets/client/auth.js

@@ -137,10 +137,15 @@
     element.dispatchEvent(new CustomEvent(name, { bubbles: true, detail }));
   }
 
-  function navigate(target) {
+  function navigate(target, allowCrossOrigin = false) {
     if (!target) return false;
     const url = new URL(target, location.href);
-    if (url.origin !== location.origin) return false;
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) return false;
+    if (url.origin !== location.origin) {
+      if (!allowCrossOrigin) return false;
+      location.assign(url.href);
+      return true;
+    }
     if (window.__wrnexusNavigate) {
       window.__wrnexusNavigate(url.pathname + url.search + url.hash);
     } else {
@@ -262,6 +267,9 @@
       );
       setState(element, "success", element.dataset.successMessage || "Signed in.");
       dispatch(element, "auth:passkey-authenticated", result);
+      // The same-origin verification endpoint resolves and validates the final
+      // destination, including cross-app SSO handoffs. Never SPA-route those.
+      if (typeof result.redirect === "string" && navigate(result.redirect, true)) return;
       if (element.dataset.redirect) navigate(element.dataset.redirect);
     } catch (error) {
       if (error && error.name === "AbortError") return;