fix(auth): keep the session id when the continue URL already has a query

[demolaf]

ContinueUrlBuilder appended ? unconditionally and then picked each parameter's separator by checking whether the last character was ?. When a consumer's continue URL already had a query string the result carried two ? and the first appended parameter was glued onto the consumer's last value — always ui_sid, the same-device session identifier, so isDifferentDevice read the same device as a different one and email-link sign-in showed a spurious cross-device prompt. Parameters were also appended after a # fragment, where they aren't query parameters at all, and values were interpolated raw.

The builder no longer does string surgery: it parses the URL once with Uri and appends through buildUpon().appendQueryParameter(...), the same parser EmailLinkParser reads the parameters back with. Separator choice, fragment placement and percent-encoding all become the platform's job instead of something this class infers. A URL with nothing appended comes back unchanged.

Added ContinueUrlBuilderTest and EmailLinkParserTest — 27 tests, Robolectric so the URLs are read back through the real android.net.Uri. Neither class had any tests before; verified they fail on the old code and pass with the fix.

---

Maintainer note: Fixes internal CPRN-434

[gemini-code-assist]

Code Review

This pull request refactors ContinueUrlBuilder to correctly handle incoming URLs that already contain query parameters or fragments, ensuring appended parameters are correctly placed before the fragment. It also adds comprehensive unit tests for ContinueUrlBuilder and EmailLinkParser. The feedback recommends URL-encoding the parameter values appended to the continue URL to prevent breaking the URL structure with special characters, and adding a corresponding unit test to verify this behavior.