Fix over-aggressive Open Redirect suppression

Previous rule suppressed ALL variable assignments from req.query which
would hide real Open Redirect vulnerabilities in other repos.

Replaced with targeted suppression: only suppress res.redirect() calls
that use explicit relative paths (./callback, etc.) which are safe by
definition. Variable assignments are now correctly flagged with LOW
confidence and require context analysis to determine if validation exists.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.py

@@ -1561,11 +1561,11 @@ _FP_SUPPRESSIONS = [
      re.compile(r'CREATE\s+\$\{\s*\w+\s*\?\s*[\'"]UNIQUE\s*[\'"]\s*:\s*[\'"][\'"]', re.IGNORECASE),
      "CREATE INDEX with internal boolean flag — not user-controlled"),
 
-    # ── Open Redirect: variable assigned but not yet used ───
-    # let redirect = req.query[...]  — assignment line alone is not a redirect
+    # ── Open Redirect: res.redirect() with a SAFE internal URL ─
+    # res.redirect(303, `./callback?${...}`)  — relative URL, safe
     ("Open Redirect",
-     re.compile(r'^\s*(let|const|var)\s+\w+\s*=\s*req\.(query|body|params)', re.IGNORECASE),
-     "Variable assignment only — redirect not issued on this line"),
+     re.compile(r'res\.redirect\s*\(\s*\d+\s*,\s*[\'"`]\./|res\.redirect\s*\(\s*[\'"`]\./', re.IGNORECASE),
+     "Redirect target is a relative path — not user-controlled"),
 ]