Use RelayState for login redirect fallback

fix(saml): correctly handle RelayState for post-auth redirect

RelayState is a standard SAML parameter used to preserve the target URL
during SSO flow. Updated implementation to properly read and forward
RelayState so users are redirected to the intended resource after
successful authentication.

server/controllers/auth.js

@@ -72,7 +72,7 @@ router.all('/login/:strategy/callback', async (req, res, next) => {
     }, { req, res })
     res.cookie('jwt', authResult.jwt, commonHelper.getCookieOpts())
 
-    const loginRedirect = req.cookies['loginRedirect']
+    const loginRedirect = req.cookies['loginRedirect'] ?? decodeURI(req.body.RelayState)
     const isValidRedirect = loginRedirect && loginRedirect.startsWith('/') && !loginRedirect.startsWith('//') && !loginRedirect.includes('://')
     if (loginRedirect === '/' && authResult.redirect) {
       res.clearCookie('loginRedirect')