fix: prevent login JS crash when returnUrl is empty

Replace eval-built form submit with tsaLogin.submitForm so a missing returnUrl no longer produces invalid JavaScript.

Co-authored-by: Cursor <cursoragent@cursor.com>

WebApp/wwwroot/js/login.js

@@ -0,0 +1,30 @@
+window.tsaLogin = {
+    /**
+     * Copies Blazor-bound credentials into the classic form fields and submits.
+     * Avoids building JS via string eval (empty returnUrl previously produced ".value = ;").
+     */
+    submitForm: function (email, password, rememberMe, returnUrl) {
+        var emailInput = document.getElementById('emailInput');
+        var passwordInput = document.getElementById('passwordInput');
+        var rememberMeInput = document.getElementById('rememberMeInput');
+        var returnUrlInput = document.getElementById('returnUrlInput');
+        var form = document.getElementById('loginForm');
+
+        if (!emailInput || !passwordInput || !rememberMeInput || !returnUrlInput || !form) {
+            console.error('tsaLogin.submitForm: login form elements not found');
+            return;
+        }
+
+        emailInput.value = email ?? '';
+        passwordInput.value = password ?? '';
+        rememberMeInput.value = rememberMe ? 'true' : 'false';
+        returnUrlInput.value = returnUrl ?? '';
+        form.submit();
+    },
+
+    blurActiveElement: function () {
+        if (document.activeElement && typeof document.activeElement.blur === 'function') {
+            document.activeElement.blur();
+        }
+    }
+};