added sharing and subscriptions

frontend/src/routes/login/+page.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { goto } from '$app/navigation';
+  import { page } from '$app/state';
   import { api, ApiError } from '$lib/api';
   import { auth } from '$lib/auth.svelte';
 
@@ -8,6 +9,15 @@
   let error = $state('');
   let busy = $state(false);
 
+  // Only follow same-origin internal paths, never an absolute/external URL.
+  const next = $derived.by(() => {
+    const n = page.url.searchParams.get('next');
+    return n && n.startsWith('/') && !n.startsWith('//') ? n : '/';
+  });
+  const registerHref = $derived(
+    next === '/' ? '/register' : `/register?next=${encodeURIComponent(next)}`
+  );
+
   async function submit(e: SubmitEvent) {
     e.preventDefault();
     error = '';
@@ -15,7 +25,7 @@
     try {
       await api.post('/auth/login', { email, password });
       await auth.refresh();
-      goto('/');
+      goto(next);
     } catch (err) {
       error = err instanceof ApiError ? err.message : 'something broke';
     } finally {
@@ -49,7 +59,7 @@
     </form>
 
     <div class="mt-5 flex justify-between text-sm text-mute">
-      <a href="/register">need an account?</a>
+      <a href={registerHref}>need an account?</a>
       <a href="/forgot">forgot password?</a>
     </div>
   </div>