/** next if it's a path on this site, else fallback (so ?next= can't send people elsewhere). */
export function safeNext(next: string | string[] | undefined | null, fallback = "/account"): string {
  if (typeof next !== "string") return fallback;
  if (!next.startsWith("/") || next.startsWith("//") || next.startsWith("/\\")) return fallback;
  return next;
}