Bugfix: Utils::apiUrl renders query params as path segments

[roncodes]

Problem

Utils::apiUrl() passed its $queryParams array straight through to Laravel's url($path, $parameters, $secure). Laravel's UrlGenerator::to() renders those extra parameters as rawurlencoded path segments with the keys discarded — it has never built a query string:

Utils::apiUrl('/api/user', ['id' => 1]);
// expected (per docblock): https://host/api/user?id=1
// actual:                  https://host/api/user/1

This silently broke every caller that passes query params. Known affected call sites:

• storefront — the QPay payment callback URL (CheckoutController.php:768) came out as .../capture-qpay/checkout_xxx, which matches no route, so QPay's server-side payment notification 404s (context: Bugfix: Patch QPay service callback URL, and ensure callbackUrl is pr… storefront#90).
• solid — the OIDC complete-registration URL (SolidIdentity.php:74).

Why tests never caught it

The Pest bootstrap runs without booting Laravel and defines its own fallback url() shim, which implemented the query-string behavior the docblock promises rather than the path-segment behavior Laravel actually has — so UtilsTest asserted ?id=1 against the fake and passed.

Fix

• Utils::apiUrl() now calls url($path, [], $secure) and appends the query string itself with http_build_query() (after the custom-port insertion, and with a & join if the path already carries a query string). Path-only callers are unaffected.
• The test shim now mirrors UrlGenerator::to()'s real path-segment semantics, so the suite can no longer mask this divergence; the existing UtilsTest query-string assertions now pass because apiUrl itself builds the query string.

consoleUrl() was already correct (builds its own query string) and is untouched.

Verification

• Ran the vendored Illuminate\Routing\UrlGenerator standalone to confirm the real url() behavior before the fix.
• Full Pest suite: 1426 passed (10013 assertions), no failures.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (04bf02e) to head (60a4a0c).

Additional details and impacted files

@@               Coverage Diff               @@
##             dev-v1.6.60      #248   +/-   ##
===============================================
  Coverage         100.00%   100.00%           
- Complexity          6732      6734    +2     
===============================================
  Files                397       397           
  Lines              22468     22470    +2     
===============================================
+ Hits               22468     22470    +2     

Flag	Coverage Δ
backend	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.