host: browser auth redirects to login (no more raw JSON 401), with return-to

Clicking "edit" while logged out returned a raw JSON 401
{"ok":false,"error":"unauthorized"} — a dead end in the browser. HTML routes
now redirect to a usable login page and return you afterwards.

- host/require-login: browser-shaped guard. Same session-or-bearer check as
  host/require-user, but on failure REDIRECTS to /login?next=<path> instead of
  JSON 401. (host/require-user stays for JSON/API routes.)
- host/-principal-of: shared session-then-bearer resolution.
- login honours ?next=: GET /login renders a hidden next field; POST /login
  redirects there on success and re-renders the form (with next) on failure.
- host/-safe-next: only same-site absolute paths are honoured — //evil.com and
  http://… fall back to "/", closing the open-redirect.
- blog: host/blog--protect-html (require-login) guards the browser routes —
  POST /new, GET/POST /:slug/edit; the JSON /posts routes keep host/require-user.

Do we need login? Yes — it's the write/edit auth boundary; without it anyone
could edit or delete posts. The bug was the dead-end 401, not the gate. Now
logged-out edit -> login -> back to edit is a clean flow.

Tests: blog no-auth write routes assert 303 + Location /login(+next); session
suite gains next round-trip + open-redirect-guard cases. 218/218.
Verified live: /welcome/edit logged out -> 303 /login?next=/welcome/edit;
login -> 303 back to /welcome/edit -> 200.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/host/tests/session.sx

@@ -69,6 +69,23 @@
 (host-se-test "login bad creds -> 401"
   (dream-status (host-se-login "admin" "wrong")) 401)
 
+;; ── return-to (?next=) after login ──────────────────────────────────
+(host-se-test "login page carries ?next in a hidden field"
+  (contains?
+    (dream-resp-body (host-se-app (dream-request "GET" "/login?next=/secure" {} "")))
+    "value=\"/secure\"")
+  true)
+(host-se-test "login redirects to next on success"
+  (dream-resp-header
+    (host-se-app (dream-request "POST" "/login" {} "username=admin&password=secret&next=/secure"))
+    "location")
+  "/secure")
+(host-se-test "login rejects open-redirect next (//evil) -> /"
+  (dream-resp-header
+    (host-se-app (dream-request "POST" "/login" {} "username=admin&password=secret&next=//evil.com"))
+    "location")
+  "/")
+
 ;; ── session-authed write ────────────────────────────────────────────
 (host-se-test "logged-in session passes the guarded write -> 201"
   (dream-status (host-se-secure (host-se-cookie-of (host-se-login "admin" "secret"))))