Preserve continue URL on auth error re-login

Failed OIDC, magic-link, and SAML sign-ins sent users to /auth/error
without the post-login destination, so Sign in dropped OAuth flows
and deep links. Propagate a validated continue query through auth
error redirects, recover it from OIDC state when the IdP denies or
cancels login, and forward it from AuthErrorPage to /auth/login.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/server/api/connect/v1/auth_error.go

@@ -35,10 +35,14 @@ const (
 	authErrorMagicLinkInvalid          = "magic_link_invalid"
 )
 
-func redirectAuthError(w http.ResponseWriter, r *http.Request, code string) {
+func redirectAuthError(w http.ResponseWriter, r *http.Request, code string, continueURL string) {
 	q := url.Values{}
 	q.Set("error", code)
 
+	if continueURL != "" {
+		q.Set("continue", continueURL)
+	}
+
 	redirectURL := url.URL{
 		Path:     "/auth/error",
 		RawQuery: q.Encode(),