refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

* refactor(auth): replace dashboard sessions with stateless tokens

* feat(auth): harden session issuance and distributed enforcement

* fix(proxy): preserve trusted proxy compatibility defaults

* refactor: address dashboard auth review feedback

* refactor: remove classic frontend and flatten web app

controller/return_path_test.go

@@ -0,0 +1,25 @@
+package controller
+
+import (
+	"testing"
+
+	"github.com/QuantumNous/new-api/setting/system_setting"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPaymentReturnPathUsesDefaultDashboardRoutes(t *testing.T) {
+	previousAddress := system_setting.ServerAddress
+	system_setting.ServerAddress = "https://dashboard.example.com/"
+	t.Cleanup(func() { system_setting.ServerAddress = previousAddress })
+
+	assert.Equal(
+		t,
+		"https://dashboard.example.com/wallet?pay=success",
+		paymentReturnPath("/wallet?pay=success"),
+	)
+	assert.Equal(
+		t,
+		"https://dashboard.example.com/usage-logs",
+		paymentReturnPath("/usage-logs"),
+	)
+}