Fix chart-page authentication and false redirects in getUser

[Saisharathchandranandnetha]

Fixes #321.

Problem

When the authentication page returns HTTP 200 without auth_token or a Location header, getUser() repeats the request six times and reports a redirect/WAF error. The missing header is passed as undefined, which selects the default URL again.

During setup, the homepage exhibited this behavior while /chart/ returned an authentication token using the same cookies. The homepage returned a token on a later check, so the deterministic regression tests model the response condition rather than assuming a permanent homepage change.

Changes

• Default getUser() to /chart/; let Client inherit that default while preserving explicit locations.
• Require a 3xx status and a nonempty Location before following a redirect.
• Resolve relative redirect URLs and reject destinations outside HTTPS TradingView hosts before forwarding cookies.
• Preserve the five-redirect limit, optional signature, and public-client behavior.
• Add HTTP and WebSocket regression coverage with mocked transports and synthetic credentials.

No dependency or Node.js requirement changes. Explicit location overrides remain supported; the JSDoc examples now point to the chart page. The separate receiver-binding change proposed in #320 is outside this patch.

Validation

Check	Result
New regression cases against unchanged upstream production code	17 failed, 9 passed
Same cases with this patch, Node 26.8.1	26 passed
Regression cases on the CI matrix: Node 14, 18, and 19	26 passed on each version
Full suite, Node 26.8.1, account credentials unset	75 passed, 16 skipped
Live authentication with saved cookies	Passed
Live authenticated BINANCE:BTCUSDT chart, 60-minute timeframe	Five candles received
ESLint on changed production files; git diff --check	Passed

Regression command:

node node_modules/vitest/vitest.mjs run tests/getUser-redirect.test.ts tests/client-auth.test.ts

Coverage includes HTTP 200/401/403 without Location, a 200 response with Location, 301/302/303/307/308 redirects, relative and regional URLs, rejected redirect destinations, successful authentication at the redirect limit, redirect loops, network errors, client token delivery, and public clients.

The full account-specific suite was not run; the live check verified account authentication and candle retrieval. The patch continues to rely on TradingView's HTML token format and does not claim to resolve every authentication or WAF failure.