fix(webauthn): preserve redirect_url after passkey login

The passkey login flow reloaded the login page once the assertion was
validated. Since the user was authenticated at that point, the login
handler redirected to the default home page and the redirect_url query
parameter was dropped.

The client now forwards redirect_url to the login finish endpoint, which
validates it as a relative path and returns the destination, falling back
to the user's default home page.

Fixes: #4494