fix: auth callback redirect, onboarding enforcement, and session validation

[SaharPak]

Summary

• Fix production OAuth/magic-link callback so Cloudflare x-forwarded-host no longer overwrites the onboarding redirect for new users
• Enforce profile setup in the proxy: signed-in users without a handle are redirected to /onboarding
• Block open redirects in login and callback via safeRedirectPath
• Replace getSession() with getUser() on server pages so auth is verified server-side

Test plan

• Google sign-in on production redirects new users to /onboarding
• Magic link sign-in completes and sets session cookies
• Returning users with a handle land on their intended redirect path
• Protected routes (/submit, /settings, /admin) still redirect unauthenticated users to /login
• Open redirect attempts (e.g. ?redirect=//evil.com) fall back to /

Made with Cursor