fix(auth): follow server redirect after passkey sign-in

packages/auth/test/components.test.ts

@@ -114,8 +114,9 @@ test("verification components can resend without application-owned schema files"
   }
 });
 
-test("auth browser runtime refuses cross-origin navigation targets", () => {
+test("auth browser runtime refuses cross-origin navigation unless explicitly server-approved", () => {
   const source = readFileSync(join(directory, "..", "assets", "client", "auth.js"), "utf8");
-  expect(source).toContain("if (url.origin !== location.origin) return false");
+  expect(source).toContain("function navigate(target, allowCrossOrigin = false)");
+  expect(source).toContain("if (!allowCrossOrigin) return false");
   expect(source).toContain("!window.AbortController");
 });