feat(backurl): support fragment in input path safely

tests/Unit/BackUrlFragmentInPathTest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Support\BackUrl;
+use Illuminate\Support\Arr;
+use Tests\TestCase;
+
+class BackUrlFragmentInPathTest extends TestCase
+{
+    public function test_with_back_should_keep_fragment_when_path_contains_hash(): void
+    {
+        $back = '/admin/platform-orders/2';
+        $backQuery = Arr::query(['back' => $back]);
+
+        $url = BackUrl::withBack('/admin/site-subscriptions/2#syncable-batch', $back);
+
+        $this->assertSame('/admin/site-subscriptions/2?' . $backQuery . '#syncable-batch', $url);
+    }
+
+    public function test_with_back_should_drop_illegal_fragment_when_path_contains_hash(): void
+    {
+        $back = '/admin/platform-orders/2';
+        $backQuery = Arr::query(['back' => $back]);
+
+        $url = BackUrl::withBack('/admin/site-subscriptions/2#bad#frag', $back);
+
+        // 非法 fragment（含 #）应丢弃，避免属性污染
+        $this->assertSame('/admin/site-subscriptions/2?' . $backQuery, $url);
+    }
+}