Fix: Replace z.httpUrl() with z.url() for localhost compatibility

z.httpUrl() rejects localhost URLs, causing Zod validation errors
during local development when verifying email. z.url() still validates
URL structure while accepting localhost, and the existing
isExternalOrigin checks already handle redirect security.

Closes #241

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: taheerahmed

src/app/api/auth/confirm/route.ts

@@ -9,7 +9,7 @@ import { z } from 'zod'
 const confirmSchema = z.object({
   token_hash: z.string().min(1),
   type: OtpTypeSchema,
-  next: z.httpUrl(),
+  next: z.url(),
 })
 
 /**

src/server/api/models/auth.models.ts

@@ -14,7 +14,7 @@ export type OtpType = z.infer<typeof OtpTypeSchema>
 export const ConfirmEmailInputSchema = z.object({
   token_hash: z.string().min(1),
   type: OtpTypeSchema,
-  next: z.httpUrl(),
+  next: z.url(),
 })
 
 export type ConfirmEmailInput = z.infer<typeof ConfirmEmailInputSchema>