feat(bookings): restrict management to assigned PIC or super admin

Secure API endpoints with requireBookingManager authorization check
Update confirmation page to prompt for login if unauthorized
Add safe redirect handling to login and guest middleware

app/pages/login/index.vue

@@ -128,6 +128,7 @@ useSeoMeta({
 })
 
 const toast = useToast()
+const route = useRoute()
 const router = useRouter()
 const auth = useAuth()
 const apiClient = useApiClient()
@@ -141,6 +142,14 @@ const form = reactive({
 const passwordPending = ref(false)
 const passkeyPending = ref(false)
 
+function getSafeRedirectPath(value: unknown) {
+  const redirect = Array.isArray(value) ? value[0] : value
+
+  return typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//')
+    ? redirect
+    : null
+}
+
 function validateLogin(state: typeof form): FormError[] {
   const errors: FormError[] = []
 
@@ -160,7 +169,7 @@ async function finishLogin(user: Awaited<ReturnType<typeof auth.fetchSession>>)
     return
   }
 
-  await router.push(getDefaultAuthenticatedPath(user))
+  await router.push(getSafeRedirectPath(route.query.redirect) || getDefaultAuthenticatedPath(user))
 }
 
 async function onSubmit(event: FormSubmitEvent<typeof form>) {