security: P0 fixes — IDOR on incident/CAPA, CAPA non-owner write, timing-safe recheck cron, auth callback open redirect

app/api/auth/callback/route.ts

@@ -5,7 +5,8 @@ import { NextResponse } from 'next/server'
 export async function GET(request: Request) {
   const { searchParams, origin } = new URL(request.url)
   const code = searchParams.get('code')
-  const next = searchParams.get('next') ?? '/'
+  const nextRaw = searchParams.get('next') ?? '/'
+  const next = nextRaw.startsWith('/') && !nextRaw.startsWith('//') ? nextRaw : '/'
 
   if (code) {
     const supabase = await createClient()