fix(auth): carry the homeserver in the query string instead of the path

[eleboucher]

Description

A homeserver typed as a full URL landed in the path as /login/http%3A%2F%2Fhost, and the hosting 307-redirects %2F to a real slash, the mangled URL then matched a room route, so after login you ended up in a fake room named "login".

The homeserver now rides in the query string (/login?server=...), old /login/<server> links (incl. SSO/OIDC callbacks) redirect to it, and auth paths are never kept as an after-login destination.

Fixes #

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings

AI disclosure:

• Partially AI assisted (clarify which code was AI assisted and briefly explain what it does).
• Fully AI generated (explain what all the generated code does in moderate detail).

[github-actions]

Deploying with    Cloudflare Workers

Status	Preview URL	Commit	Alias	Updated (UTC)
✅ Deployment successful!	https://pr-1582-sable.raspy-dream-bb1d.workers.dev	25ee7b9	pr-1582	Sun, 02 Aug 2026 18:05:04 GMT