Fix SSO return-to redirect loop

SetReturnToCookie stored /sso/redirect as the return-to path,
causing a redirect loop after successful SSO login: the callback
would redirect back to /sso/redirect instead of /. Filter all
/sso/* paths, not just /sso/callback.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sso/sso_test.go

@@ -193,7 +193,7 @@ func TestReturnToDefaultsToRoot(t *testing.T) {
 }
 
 func TestReturnToSkipsLoginPaths(t *testing.T) {
-	for _, p := range []string{"/login", "/sso/callback"} {
+	for _, p := range []string{"/login", "/sso/callback", "/sso/redirect"} {
 		rec := httptest.NewRecorder()
 		req := httptest.NewRequest(http.MethodGet, p, nil)
 		SetReturnToCookie(rec, req, "mcr")