Hi arpinux,
thank you for the feedback.
Fixed
Login — redirect after authentication now returns to the originally requested page (app/Middleware/AuthMiddleware.php, app/Controllers/Auth/LoginController.php, app/Views/discussions/show.php, themes/premium/views/discussions/show.php) — When a guest tried to access a protected URL they were redirected to /login but after a successful login (including after 2FA) they were always sent to the home page. The requested URI is now saved in session (redirect_after_login) before the login redirect; LoginController::login() and verify2FA() consume it after a successful authentication and fall back to / if absent. The “Log in to reply” links and reply placeholder in discussion pages pass the discussion URL with #reply-form as a ?redirect=query parameter; LoginController::show() reads it and saves it to session. Protocol-relative URLs (//evil.com) are explicitly rejected in addition to absolute URLs to prevent open redirects. After redirect, #reply-form in the URL hash is detected on page load and showReplyEditor() is called automatically so the editor opens and scrolls into view without requiring a click.