Keep file name when a redirect Location is query-only

Found while testing crates/fetch/src/http.rs:139 (Url::join)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

crates/fetch/src/http.rs

@@ -137,6 +137,10 @@ impl Url {
         }
         // relative to the current directory
         let dir = self.path.split('?').next().unwrap_or("/");
+        // a query-only reference keeps the whole path, file name included (RFC 3986 §5.2.2)
+        if l.starts_with('?') {
+            return Url::parse(&format!("{base}{dir}{l}"));
+        }
         let dir = dir.rsplit_once('/').map_or("", |(d, _)| d);
         Url::parse(&format!("{base}{dir}/{l}"))
     }
@@ -618,6 +622,12 @@ mod tests {
         assert!(Url::parse("https://example.com/x?secret=abc\r\nInjected: 1").is_err());
     }
 
+    #[test]
+    fn join_query_only_keeps_file_name() {
+        let u = Url::parse("https://a.example/x/y/file?q=1").unwrap();
+        assert_eq!(u.join("?page=2").unwrap().path, "/x/y/file?page=2");
+    }
+
     #[test]
     fn parses_urls() {
         let u = Url::parse("https://cdn.example.com/models/sam3/model.safetensors?sig=1#x").unwrap();