A test pins the open-redirect guard: `isLocalPath` and a form's `back` refuse every off-origin form #6620

Intent: the one rule every form uses to choose where it lands (isLocalPath in src/web/flash.ts, read by backTo in src/web/form.ts) has no direct test. A regression there would be an open redirect.

Done:

• [ ] A new test/local-path.test.ts with a table. Refused: //evil.example, /\evil.example, https://evil.example, javascript:alert(1), evil.example/x, the empty string, a path with a tab, newline or NUL, a path with a backslash anywhere, and a 513-character path. Accepted: /, /a/b?c=d#e, /%2F%2Fx and a 512-character path.
• [ ] backTo returns the fallback for each refused value and the value itself for each accepted one, built from a real FormData.
• [ ] If a case on the refused list passes the guard today, the same pull fixes src/web/flash.ts and says so.
• [ ] bun test test/local-path.test.ts passes.

Files: test/local-path.test.ts, src/web/flash.ts