feat(auth): implement all 16 homepage/login/register review items

- add countArticles() (published-only, mirrors news-list) and warm total_articles
- localize homepage metadata; bind articleCount to both stats; unique photo alts
- drop duplicate news date and the mascot preload priorities
- extract shared AuthPageFrame/AuthUsersCards used by /login and /register
- login: localized noindex metadata, session redirect via safeRedirectPath,
  ?from passthrough from proxy, unified auth roster cache keys, registered notice
- register: localized metadata, session redirect to /me, unified cache keys
- add resend-verification flow on /verify with rate-limited non-enumerable action
- add safeRedirectPath() with unit tests
- register form: live requirements checklist + password mismatch guard
- login form: unverified state with resend-link CTA
- honour prefers-reduced-motion in TypewriterText
- add 6 translations across all 25 locales

src/lib/auth/safe-redirect.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+import { safeRedirectPath } from "./safe-redirect";
+
+describe("safeRedirectPath", () => {
+	it("keeps same-site destinations", () => {
+		expect(safeRedirectPath("/admin/users")).toBe("/admin/users");
+		expect(safeRedirectPath("/me")).toBe("/me");
+		expect(safeRedirectPath("/login?from=%2Fadmin")).toBe(
+			"/login?from=%2Fadmin",
+		);
+		expect(safeRedirectPath("/news/welcome#comments")).toBe(
+			"/news/welcome#comments",
+		);
+	});
+
+	it("refuses cross-origin and non-path destinations", () => {
+		expect(safeRedirectPath("//evil.example")).toBe("/me");
+		expect(safeRedirectPath("/\\evil.example")).toBe("/me");
+		expect(safeRedirectPath("https://evil.example")).toBe("/me");
+		expect(safeRedirectPath("javascript:alert(1)")).toBe("/me");
+		expect(safeRedirectPath("admin")).toBe("/me");
+	});
+
+	it("treats a missing value as the fallback", () => {
+		expect(safeRedirectPath(undefined)).toBe("/me");
+		expect(safeRedirectPath(null)).toBe("/me");
+		expect(safeRedirectPath("")).toBe("/me");
+		expect(safeRedirectPath(undefined, "/admin")).toBe("/admin");
+	});
+});

src/lib/auth/safe-redirect.ts

@@ -0,0 +1,17 @@
+/**
+ * Validate a post-login destination taken from the query string.
+ *
+ * The value ends up in `window.location.href`, so an unvalidated one turns the
+ * sign-in form into an open redirect. Only same-site absolute paths pass:
+ * `//host` and `/\host` are cross-origin in every browser, and anything without
+ * a leading slash is not a path at all.
+ */
+export function safeRedirectPath(
+	raw: string | null | undefined,
+	fallback = "/me",
+): string {
+	if (!raw) return fallback;
+	if (!raw.startsWith("/")) return fallback;
+	if (raw.startsWith("//") || raw.startsWith("/\\")) return fallback;
+	return raw;
+}