Add test case for URL containing control character (null byte) which triggers url.Parse error and returns path unchanged. Coverage improved from 88.9% to 100%.
- sanitizeOIDCReturnTo: path validation, protocol-relative URL rejection - addQueryParam: URL building, encoding, fragment preservation - extractStringClaim: type handling (string, []string, []interface{}) - extractStringSliceClaim: slice extraction with comma/space splitting - matchesValue: case-insensitive value matching - matchesDomain: email domain validation with @ handling - intersects: set intersection with case normalization - buildRedirectURL: proxy header handling (X-Forwarded-Proto/Host) Coverage: api 26.7% → 27.7%
