Redirect Trust Boundary Break

Client-controlled or attacker-influenced redirects let untrusted parties shape the post-payment flow, so parameters like paystate are treated as proof and landing routes can bypass auth/middleware or loop until ERR_TOO_MANY_REDIRECTS.