hardening: sanitize session/referrer-based redirect targets in threshold flows

[somethingwithproof]

Summary

Several threshold flow redirects reuse session/referrer URLs directly in header('Location: ...') without sanitization.

Locations

• thold.php (autocreate, disable, enable flows)
• thold_templates.php save flow (graph_return path)
• thold_webapi.php graph-return redirect

Risk

If session/referrer values are tampered or unexpectedly external, redirect behavior can be unsafe or inconsistent.

Expected

Pass dynamic return URLs through the same sanitization utility already used elsewhere in the plugin (e.g., sanitize_uri()), with safe fallback targets when empty/invalid.