fix(files): support ?file= param as login-safe alternative to #hash

Hash fragments never reach the server so they're lost during login
redirects. ?file= survives the ?next= flow; #hash still works for
direct access when already logged in.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dashboard/files.html

@@ -1807,6 +1807,9 @@
         });
         
         function getPathFromURL() {
+            // ?file= survives login redirects; #hash works when already logged in.
+            const qp = new URLSearchParams(window.location.search).get('file');
+            if (qp) return decodeURIComponent(qp);
             const hash = window.location.hash;
             return hash ? decodeURIComponent(hash.slice(1)) : '';
         }