docs/oidc.md documents `returnTo` for the OIDC login endpoint; the server reads `redirect`

[mairas]

Description

The API Reference in docs/oidc.md documents the OIDC login endpoint's return-target query parameter as returnTo. The server reads redirect. A webapp that follows the documentation gets no return target at all: the value is ignored and the user lands on / after login.

docs/oidc.md (line 389):

GET /signalk/v1/auth/oidc/login

Query parameters:

- `returnTo` (optional): URL to redirect after successful login

The handler in src/oidc/oidc-auth.ts (line 281):

// Store original destination (validated to prevent open redirect attacks)
const requestedRedirect = req.query.redirect
const originalUrl = isSafeRelativeUrl(requestedRedirect) ? requestedRedirect : '/'

The docs contradict each other

docs/develop/webapps.md (line 312) documents the same endpoint correctly:

/signalk/v1/auth/oidc/login?redirect=/your/path

So the two documents disagree, and the one titled "API Reference" is the wrong one.

No version has ever read returnTo

git log -S returnTo -- src packages on master returns nothing — the name has never existed in the source. It entered the docs with the original OIDC guide (42deede, "docs: add OIDC configuration guide with Authelia example") and has been wrong since.

Verified against master at 2495b86.

Steps to reproduce

1. Configure OIDC.
2. As an unauthenticated user, open /signalk/v1/auth/oidc/login?returnTo=%2Fsome%2Fwebapp.
3. Complete the login at the provider.
4. Expected (per docs): browser lands on /some/webapp.
5. Actual: browser lands on /.
6. Repeat with ?redirect=%2Fsome%2Fwebapp — lands on /some/webapp.

Suggested fix

Rename the parameter to redirect in the docs/oidc.md API Reference, and state the same-origin constraint that isSafeRelativeUrl enforces (must start with / but not //, no backslashes or control characters), matching the wording already in docs/develop/webapps.md.

While in that section: the logout endpoint GET /signalk/v1/auth/oidc/logout is absent from the API Reference and accepts the same redirect parameter (src/oidc/oidc-auth.ts line 481) as a post-logout target. Worth documenting alongside.

Context

Found while building a Signal K webapp against the OIDC login flow — we had to read the server source to discover which name actually works.

Same shape as #2592 (local=true documented, noAutoLogin=true implemented).