Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is home.

redirect_to and next must start with a single slash. Protocol-relative, external, and @-host tricks fall back to /.

After a valid confirm, web continues to that path. Native opens the in-app home.