Use UTF-8 safe return-to encoding and decoding across router and login

Co-Authored-By: Codex <codex@openai.com>

src/utils/returnToEncoding.js

@@ -0,0 +1,30 @@
+// The Lucia project.
+// Copyright 2026-2026 DSP, inc.  All rights reserved.
+// Authors:
+//   imacat.yang@dsp.im (imacat), 2026/03/08
+/** @module returnToEncoding UTF-8 safe base64 helpers for return-to paths. */
+
+/**
+ * Encodes a return-to path into UTF-8 safe base64.
+ * @param {string} returnToPath - The relative path to preserve.
+ * @returns {string} Base64-encoded UTF-8 string.
+ */
+export function encodeReturnTo(returnToPath) {
+  const bytes = new TextEncoder().encode(returnToPath);
+  let binary = "";
+  bytes.forEach((byte) => {
+    binary += String.fromCharCode(byte);
+  });
+  return btoa(binary);
+}
+
+/**
+ * Decodes a UTF-8 safe base64 return-to payload back to a path.
+ * @param {string} encodedReturnTo - Base64 payload from query parameter.
+ * @returns {string} Decoded path string.
+ */
+export function decodeReturnTo(encodedReturnTo) {
+  const binary = atob(encodedReturnTo);
+  const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}