Fix MCP OAuth redirect staying on Twenty dashboard after SSO

[UsamaSadiq]

Description

After MCP OAuth login (via SSO proxy-login), users land on the Twenty dashboard instead of being redirected back to the /authorize consent screen. This breaks the MCP client auth flow (Claude Desktop, Cursor).

Root cause: returnToPath is stored in a Jotai atom (in-memory) which is destroyed when SignInUp.tsx does a full-page window.location.replace() to /auth/sso/proxy-login. The controller always redirects to / after setting the JWT cookie.

Fix: thread returnToPath as a query parameter through the proxy-login redirect, so the controller can redirect back to /authorize?... after setting the JWT cookie. The value is validated to prevent open redirect attacks.

Testing

1. Connect an MCP client (Claude Desktop or MCP Inspector) to https://twenty.<domain>/mcp
2. The OAuth flow should open a browser, go through SSO login, and return to the consent screen
3. After granting consent, the MCP client should receive the auth code and complete the flow
4. Verify that normal SSO login (not MCP) still redirects to the dashboard

[github-actions]

	Fails
🚫	node failed.

Log

Details

�[31mError: �[39m SyntaxError: Unexpected token '<', "<!DOCTYPE "... is not valid JSON
    at JSON.parse (<anonymous>)
�[90m    at parseJSONFromBytes (node:internal/deps/undici/undici:4387:19)�[39m
�[90m    at successSteps (node:internal/deps/undici/undici:7041:27)�[39m
�[90m    at readAllBytes (node:internal/deps/undici/undici:5958:13)�[39m
�[90m    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)�[39m
danger-results://tmp/danger-results-a751be74.json

Generated by 🚫 dangerJS against 4588cfd