Function app_safe_next_path 

fn app_safe_next_path(
    app: &AppRuntime,
    candidate: &str,
    fallback: &str,
) -> String

Returns one redirect-safe internal next path or the provided fallback.