fix(ui): document viewer back button returns to the page you came from (chat or sources)

frontend/assets/document.js

@@ -28,14 +28,31 @@ const notFoundEl = document.querySelector("#doc-not-found");
 const mainEl = document.querySelector("#main");
 const backLink = document.querySelector("#doc-back");
 
-/* Back: prefer the browser's own history when there is one (the viewer was
- * opened from this tab's session); a fresh tab lands on the Sources page. */
-backLink.addEventListener("click", (e) => {
-  if (window.history.length > 1) {
-    e.preventDefault();
-    window.history.back();
-  }
-});
+/* Back button (phase 13): the return target comes from the `back` query
+ * param, not the browser history — both entry points (chat source chips
+ * and the Sources table) open the viewer in a NEW tab, where there is no
+ * history to go back to. The param is honored only for same-origin
+ * relative URLs (starts with "/" but not "//"), so absolute (https://…),
+ * protocol-relative (//…), and pseudo-protocol (javascript:…) values are
+ * rejected; anything else falls back to the Sources page. The static
+ * href="/sources.html" in document.html remains the no-JS fallback, and
+ * with the href set the anchor's default click behavior IS the
+ * deterministic navigation (no browser-history heuristics). */
+const backParam = params.get("back") || "";
+const backTarget =
+  backParam.startsWith("/") && !backParam.startsWith("//")
+    ? backParam
+    : "/sources.html";
+backLink.href = backTarget;
+const backLabel = backLink.querySelector("span");
+if (backLabel) {
+  backLabel.textContent =
+    backTarget === "/"
+      ? "Chat"
+      : backTarget === "/sources.html"
+        ? "Sources"
+        : "Back";
+}
 
 function fmtDate(iso) {
   try {