Magic-link login from calypso.localhost loses redirect_to, lands on wordpress.com home

[robertbpugh]

Summary

When the local Calypso dev server (calypso.localhost:3000) redirects an unauthenticated user to wordpress.com login, and the user picks Email me a login link, the resulting magic-link email drops the originating redirect_to parameter. Clicking the link logs the user into wordpress.com and lands them on wordpress.com/home/... rather than bouncing back to the calypso.localhost target. The wp.com session cookie sets on .wordpress.com only, so calypso.localhost remains logged out.

Steps to reproduce

1. Open http://calypso.localhost:3000/<any-protected-route> while logged out (e.g. a /podcasting/stats/<site> URL).
2. Calypso redirects to its /log-in?...&redirect_to=... and forwards through to wordpress.com login.
3. Click Email me a login link with a valid wp.com account email.
4. Open the email in the same Chrome window, click the link.
5. Observe landing on wordpress.com/home/... rather than the originating calypso.localhost URL.
6. Reload the calypso.localhost target. Still logged out.

Expected

After clicking the magic link, end up at the originating calypso.localhost:3000/<route> URL with a valid local Calypso session.

Related friction

The 2FA UI on calypso.localhost shows the security-key challenge with no "Try another method" fallback link. Users with passkeys registered for wordpress.com cannot use them here, since passkeys are origin-bound and calypso.localhost is a different origin. Magic-link is the natural fallback, which makes the redirect-loss bug a hard blocker for getting into local dev.

Environment

• Local Calypso dev server on macOS, Chrome 147
• Branch: try/pods-95-podcast-stats-ui (issue is unrelated to that branch, observed during UI testing)