fix(apps): re-check access in place after a password sign-in (#11166)

* fix(apps): re-check access in place after a password sign-in

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* style: drop redundant comment in the password sign-in hand-back

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

frontend/src/lib/components/Login.svelte

@@ -61,6 +61,10 @@
 		popup?: boolean
 		firstTime?: boolean
 		autoRedirect?: boolean
+		/** Supplying this replaces the post-login redirect: the card hands back instead of
+		 * navigating, and the host is expected to re-check access in place. For a gate on a
+		 * page that stays mounted, `rd` is the URL already shown, so navigating there would
+		 * re-run nothing. */
 		onLoginSuccess?: () => void
 		/** A refusal the popup relayed back, in the server's words. */
 		onLoginError?: (message: string) => void
@@ -290,6 +294,11 @@
 
 		// Finally, we check whether the user is a superadmin
 		refreshSuperadmin()
+
+		if (onLoginSuccess) {
+			onLoginSuccess()
+			return
+		}
 		redirectUser()
 	}