[rnicholls]

Summary

Adds optional external login and signup redirects for self-hosted FeedLog installations that use an existing application for authentication.

Changes

• Introduces EXTERNAL_LOGIN_URL and EXTERNAL_SIGNUP_URL.
• Routes ordinary login, signup, voting, commenting, and feedback submission authentication through a centralized redirect.
• Preserves the original FeedLog page and safe query parameters using return_to.
• Supports either URL independently, with fallback to the configured endpoint.
• Keeps local-credential-required operations using Better Auth.
• Preserves existing authentication behavior when external URLs are not configured.
• Reuses the existing JWT SSO endpoint without modifying its behavior.
• Adds configuration and SSO documentation.

Security

• Validates external authentication URLs.
• Restricts return destinations to the trusted FeedLog origin.
• Rejects unsafe return destinations and strips credential-shaped query parameters.
• Prevents direct redirect loops.
• Handles authentication configuration failures with a localized retry screen.

Validation

• 9 focused tests passed.
• Nuxt/Vue TypeScript checks passed.
• ESLint passed on affected files.
• i18n parity passed for English and Chinese.
• git diff --check passed.

Compatibility

• No database migrations.
• No new dependencies.
• No changes to existing JWT SSO behavior.
• Existing Better Auth login/signup remains unchanged when external authentication is not configured.

[rnicholls]

@EndlessCCL not sure what I am supposed to do past this point.