fix: correct audit event names, attachment deletion, redirect safety, and add account deactivation check

- Fix audit event names in CLI prune/clear commands from `cli.seo.*` to `cli.seo_meta.*`
- Refactor `_delete_attachment_file` to accept full attachment dict instead of storage_path string, using directory and stored_name fields with ATTACHMENTS_DIR
- Add `safe_next` validation for referer header in validation error redirect and media redirect
- Add `is_active` check in login router to reject deactivated accounts with "Account is deactivated" error
- Replace raw `request.headers.get("Referer")` with `redirect_back()` utility in bookmarks, polls, reactions, and votes routers
- Move `mark_conversation_read` call from `get_conversation_messages` to `messages_page` to avoid side effects during message retrieval
- Fix poll audit link to use `option.get("label")` instead of `option.get("text")`
- Add `VOTABLE` set validation in votes router to reject invalid target types with 400 response
- Strip control characters (0x00-0x20) from URLs in `_safe_url` instead of simple strip
- Add `__getattr__` fallback in services `__init__.py` for dynamic attribute access

devplacepy/routers/bookmarks.py

@@ -4,7 +4,7 @@ from datetime import datetime, timezone
 from fastapi import APIRouter, Request
 from fastapi.responses import RedirectResponse, JSONResponse, HTMLResponse
 from devplacepy.database import get_table, db, paginate, resolve_object_url, _now_iso
-from devplacepy.utils import generate_uid, require_user, time_ago
+from devplacepy.utils import generate_uid, require_user, time_ago, redirect_back
 from devplacepy.seo import base_seo_context
 from devplacepy.responses import respond
 from devplacepy.schemas import SavedOut
@@ -137,6 +137,4 @@ async def toggle_bookmark(request: Request, target_type: str, target_uid: str):
 
     if request.headers.get("x-requested-with") == "fetch":
         return JSONResponse({"saved": saved})
-    return RedirectResponse(
-        url=request.headers.get("Referer", "/feed"), status_code=302
-    )
+    return RedirectResponse(url=redirect_back(request), status_code=302)