Fix NyxID service access review return routing

[AbigailDeng]

Problem

Workflow Activity vNext supplied its scoped Account settings URL when starting a NyxID service access review, but the shared auth client replaced it with the legacy /settings?section=account route. Approval, denial, and retry therefore returned users to the wrong product surface.

Solution

• Make each Settings surface own and pass its canonical Account return URL.
• Add buildWorkflowActivitySettingsHref(scopeId, section) and use it for vNext Settings navigation and review recovery.
• Replace permissive redirect options with a discriminated union that requires returnTo for serviceAccessReview and keeps consent mandatory.
• Preserve the sanitized pending route through callback success, denial, finalization failure, back navigation, and retry.
• Remove the legacy Settings route from shared auth; invalid review targets now fall back to CONSOLE_HOME_ROUTE.

Impact

• vNext review return: /scopes/:scopeId/workflow-activity-vnext/settings?section=account
• Legacy review return remains locally owned: /settings?section=account
• No backend, persistence, or deployment configuration changes.

Local verification

• Direct changed tests: pnpm exec jest src/pages/auth/callback/index.test.tsx src/pages/workflow-activity-vnext/navigation.test.ts src/pages/workflow-activity-vnext/settings/AccountPanel.test.tsx src/shared/auth/client.test.ts --runInBand - 4 suites, 39 tests passed.
• Dependency-related tests: pnpm exec jest --findRelatedTests src/pages/auth/callback/index.tsx src/pages/settings/accountContent.tsx src/pages/workflow-activity-vnext/navigation.ts src/pages/workflow-activity-vnext/settings/AccountPanel.tsx src/pages/workflow-activity-vnext/settings/SettingsPage.tsx src/shared/auth/client.ts --runInBand - 57 suites, 1138 tests passed.
• Post-format focused tests: pnpm exec jest src/pages/auth/callback/index.test.tsx src/pages/settings/index.test.tsx src/pages/workflow-activity-vnext/navigation.test.ts src/pages/workflow-activity-vnext/settings/AccountPanel.test.tsx src/shared/auth/client.test.ts --runInBand - 5 suites, 66 tests passed.
• vNext Settings integration: pnpm exec jest src/pages/workflow-activity-vnext/index.test.tsx --runInBand -t "renders authoritative identity and the effective workflow execution target" - 1 test passed.
• Changed-file static checks: pnpm exec biome check <10 analyzer-reported files> - passed with no fixes required.
• Stability guard: bash tools/ci/test_stability_guards.sh - passed.
• Full frontend typecheck, suite, and production build: deferred to GitHub CI by personal local workflow policy.