Preserve monthly recap destinations through sign-in

scripts/review_monthly_reports_ui.cjs

@@ -45,6 +45,7 @@ const output = process.env.REVIEW_DIR
       const url = new URL(request.url())
       calls.push({ method: request.method(), path: url.pathname, month: url.searchParams.get('month') })
       if (url.pathname === '/api/auth/me') return route.fulfill({ json: { username: 'Fixture viewer', role } })
+      if (url.pathname === '/api/auth/jellyfin/login' || url.pathname === '/api/auth/login') return route.fulfill({ json: { authenticated: true } })
       if (url.pathname.startsWith('/api/insights/artwork/')) return route.fulfill({ contentType: 'image/svg+xml', body: '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 120 180"><rect width="120" height="180" fill="#243946"/><path d="M0 150L65 35L120 150" fill="#c8bdaa"/></svg>' })
       if (url.pathname === '/api/insights/reports/monthly.csv') {
         if (failDownload) return route.fulfill({ status: 502, json: { detail: 'Unavailable' } })
@@ -138,6 +139,19 @@ const output = process.env.REVIEW_DIR
     await page.waitForURL(/\/login\?next=/)
     assert.equal(new URL(page.url()).searchParams.get('next'), `/insights/reports?month=${months.at(-1)}`)
     mode = 'ready'
+    await page.getByLabel('Username', { exact: true }).fill('fixture-viewer')
+    await page.getByLabel('Password', { exact: true }).fill('Fixture-only-password')
+    await page.getByRole('button', { name: 'Sign in', exact: true }).click()
+    await page.getByRole('heading', { name: 'October 2024', exact: true }).waitFor()
+    assert.equal(new URL(page.url()).searchParams.get('month'), months.at(-1))
+    // An external or unrecognized destination must still use the safe welcome fallback.
+    for (const next of ['https://outside.example.test', '//outside.example.test', '/insights/reports?month=2026-07&redirect=https://outside.example.test']) {
+      await page.goto(`${base}/login?next=${encodeURIComponent(next)}`)
+      await page.getByLabel('Username', { exact: true }).fill('fixture-viewer')
+      await page.getByLabel('Password', { exact: true }).fill('Fixture-only-password')
+      await page.getByRole('button', { name: 'Sign in', exact: true }).click()
+      await page.waitForURL(`${base}/welcome`)
+    }
     await page.goto(base + '/insights/reports')
     await page.getByRole('heading', { name: 'August 2026', exact: true }).waitFor()
     await page.getByRole('navigation', { name: 'My Stats views' }).getByRole('link', { name: 'Overview' }).click()