fix: redirect to frontend after OAuth callback instead of returning JSON

- /auth/callback now redirects to frontend URL with session cookie
- /auth/login stores 'next' path in cookie for post-login redirect
- User is redirected to their original destination after authentication

apps/api/src/api/auth.py

@@ -26,7 +26,7 @@ async def get_db_session() -> AsyncGenerator[AsyncSession, None]:
 
 
 @router.get("/login")
-async def login() -> RedirectResponse:
+async def login(next: str = "/") -> RedirectResponse:
     settings = Settings()
     redirect_uri = f"{settings.api_base_url}/auth/callback"
     state = token_urlsafe(24)
@@ -35,9 +35,10 @@ async def login() -> RedirectResponse:
         redirect_uri=redirect_uri,
         state=state,
     )
-    logger.info("Auth login initiated: redirect_uri=%s", redirect_uri)
+    logger.info("Auth login initiated: redirect_uri=%s, next=%s", redirect_uri, next)
     response = RedirectResponse(location)
     response.set_cookie("auth_state", state, httponly=True, samesite="lax")
+    response.set_cookie("auth_next", next, httponly=True, samesite="lax")
     return response
 
 
@@ -47,8 +48,9 @@ async def callback(
     state: str,
     response: Response,
     auth_state: str | None = Cookie(default=None),
+    auth_next: str | None = Cookie(default="/"),
     session: AsyncSession = Depends(get_db_session),
-) -> dict[str, str]:
+) -> RedirectResponse:
     logger.info("Auth callback received: code=%s... state=%s", code[:10] if code else "None", state[:10] if state else "None")
     
     if auth_state is None or auth_state != state:
@@ -114,9 +116,13 @@ async def callback(
     cookie_secure = bool(cookie_options["secure"])
     response.set_cookie("session", session_cookie, httponly=True, samesite=cookie_samesite, secure=cookie_secure)
     response.delete_cookie("auth_state", samesite="lax")
+    response.delete_cookie("auth_next", samesite="lax")
 
-    logger.info("Auth callback complete for user id=%s", user.id)
-    return {"sub": str(user.id), "email": user.email, "name": user.name}
+    logger.info("Auth callback complete for user id=%s, redirecting to %s", user.id, auth_next)
+    
+    # Redirect to frontend with the original next path
+    redirect_url = f"{settings.web_base_url}{auth_next}"
+    return RedirectResponse(url=redirect_url)
 
 
 @router.post("/logout")