Validate and allowlist deep-link targets to prevent open redirect and…

[heymide]

Close: #1141

Here's a summary of the changes:
Files created

• src/deep-link/deep-link.service.ts — New DeepLinkService with:
• Route allowlist — only course (web + app) is allowed; rejects admin, settings, etc.
• Param validation — rejects absolute URLs (http://), external schemes (javascript:, data:, vbscript:), path traversal (../, ..), injection characters (< > { } " ' \ ), and invalid chars (spaces, @, #, ?`)
• buildDeepLink — builds /course/{id} for web or teachlink://course/{id} for app with URL-encoding
• HMAC signing — signLink / verifyLink for sensitive link integrity
• src/deep-link/deep-link.service.spec.ts — 18 unit tests covering valid/invalid routes, params, link building, and signing
  Files updated
• src/deep-link/deep-link.controller.ts — Injects DeepLinkService, replaces raw string interpolation with buildDeepLink() so all validation runs before redirect
• src/deep-link/deep-link.module.ts — Registers DeepLinkService as a provider
• test/deep-link.e2e-spec.ts — 4 new e2e tests: absolute URL rejection, external scheme rejection, path traversal rejection, injection character rejection
  Test results
• Unit: 18/18 passed
• E2E: 8/8 passed

[drips-wave]

@heymide Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[heymide]

Done, Close: #1186

[RUKAYAT-CODER]

Thank you for contributing to the project.