Handle null history.state in client-side router popstate handler (#90083)
### What?
Handle `null` `history.state` in the client-side router's `popstate`
handler.
### Why?
When `pushState` or `replaceState` is called outside of Next.js with a
`null` state (or the initial history entry has no state), navigating
back/forward to that entry fires a `popstate` event with `event.state
=== null`. Previously, the `onPopState` handler returned early without
doing anything, leaving the router tree completely out of sync with the
browser URL — `usePathname()`, `useSearchParams()`, etc. would return
stale values.
### How?
When `event.state` is `null`, call `window.location.reload()` to perform
a hard navigation, the same behavior as when a non-Next.js history entry
is encountered (`!event.state.__NA`). This ensures the router always
returns to a consistent state.
Added an e2e test that:
1. Navigates to a second page via client-side Link
2. Pushes history entries with truly `null` state (via
`History.prototype.pushState` to bypass the Next.js patch)
3. Goes back and verifies the page correctly reloads
Fixes #90080