A native client (desktop/mobile/etc.) opens /oauth/authorize in the OS
browser. When the user is unauthenticated, the router previously saved the
destination to localStorage and redirected to a bare /login, stripping the
authorize URL from the address bar. localStorage is per-browser, so a user
who is signed in (or wants to sign in) in a different browser could not copy
the URL over and complete the flow.
Now, when an unauthenticated user hits oauth.authorize, redirect to /login
with the authorize path+query encoded in a #redirect= hash. The hash keeps
the URL copyable across browsers while keeping the embedded OAuth params out
of server/proxy access logs (a query param would be logged).
On arrival at the auth route, the hash is decoded and folded back into the
existing localStorage redirect mechanism (saveLastVisited), so redirectIfSaved()
completes the journey after any auth method - including the external OIDC
round-trip, where localStorage is the only bridge that survives leaving the SPA
(populated before the user leaves to the IdP). Scoped strictly to
oauth.authorize for all client_ids; every other route keeps its existing
localStorage redirect behavior.
Fixes#2654
a9355fc247