fix: harden booking and meeting flows

lib/auth/redirect.ts

@@ -0,0 +1,5 @@
+/** Only origin-relative application paths may be used after login. */
+export function safeLoginRedirect(value: string | null): string {
+  if (!value || !value.startsWith("/") || value.startsWith("//") || /[\\\u0000-\u0020]/.test(value)) return "/konto";
+  return value;
+}