Harden tenant admin auth and photo moderation

tests/Feature/Auth/LoginTest.php

@@ -184,6 +184,30 @@ class LoginTest extends TestCase
         $response->assertRedirect('/event-admin/dashboard');
     }
 
+    public function test_tenant_admin_login_rejects_lookalike_return_host(): void
+    {
+        $user = User::factory()->create([
+            'email' => 'hostcheck@example.com',
+            'role' => 'tenant_admin',
+            'password' => bcrypt('password'),
+            'email_verified_at' => now(),
+        ]);
+
+        $appHost = parse_url(config('app.url'), PHP_URL_HOST) ?? 'localhost';
+        $targetHost = 'evil-'.$appHost;
+        $target = "https://{$targetHost}/event-admin/dashboard";
+        $encodedReturn = rtrim(strtr(base64_encode($target), '+/', '-_'), '=');
+
+        $response = $this->post(route('login.store'), [
+            'login' => 'hostcheck@example.com',
+            'password' => 'password',
+            'return_to' => $encodedReturn,
+        ]);
+
+        $this->assertAuthenticatedAs($user);
+        $response->assertRedirect('/event-admin/dashboard');
+    }
+
     public function test_tenant_admin_can_access_login_with_admin_return_path_when_authenticated()
     {
         $user = User::factory()->create([