fix(site): parse the bounce ?p= value through URL before restoring

Build the restored URL by feeding `p` into the URL constructor and
appending any extra search params from the bounce URL. The old version
concatenated strings, which produced a malformed `/foo?a=1?x=2` if `p`
already carried a query (or an extra param landed on the bounce URL).

Also reject `p` values that don't look like same-origin relative paths
so a crafted `?p=//host/foo` can't try to flip the visible origin.

Addresses Copilot feedback on #15.

Author: DevelopmentCats

site/index.html

@@ -16,10 +16,22 @@
       (function () {
         var url = new URL(window.location.href);
         var p = url.searchParams.get("p");
-        if (p) {
-          url.searchParams.delete("p");
-          window.history.replaceState(null, "", p + url.search + url.hash);
-        }
+        // Only restore same-origin relative paths so a crafted ?p= can't try
+        // to replace the visible origin (replaceState would throw anyway).
+        if (!p || p[0] !== "/" || p[1] === "/") return;
+        url.searchParams.delete("p");
+        // Parse `p` through URL so its own query/hash compose cleanly with
+        // whatever extra params or hash were on the bounce URL.
+        var restored = new URL(p, window.location.origin);
+        url.searchParams.forEach(function (value, key) {
+          restored.searchParams.append(key, value);
+        });
+        if (!restored.hash) restored.hash = url.hash;
+        window.history.replaceState(
+          null,
+          "",
+          restored.pathname + restored.search + restored.hash,
+        );
       })();
     </script>