fix: resolve final workbench review findings

apps/web/src/features/auth/ServerLogin.svelte

@@ -9,16 +9,19 @@
   let connectionStatus = 'Not connected. Enter a server address to continue.';
 
   function normalizeServer(value: string): { apiBase?: string; error?: string } {
-    const trimmed = value.trim();
-    if (!trimmed) {
+    if (!value.trim()) {
       return { error: 'Enter a server address.' };
     }
 
-    const candidate = /^https?:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`;
+    if (hasWhitespace(value) || hasUnsupportedProtocol(value)) {
+      return { error: 'Enter a valid HTTP or HTTPS server address.' };
+    }
+
+    const candidate = /^https?:\/\//i.test(value) ? value : `http://${value}`;
 
     try {
       const parsed = new URL(candidate);
-      if (!parsed.hostname || !['http:', 'https:'].includes(parsed.protocol)) {
+      if (!parsed.hostname || parsed.username || parsed.password || !['http:', 'https:'].includes(parsed.protocol)) {
         return { error: 'Enter a valid HTTP or HTTPS server address.' };
       }
       return { apiBase: candidate };
@@ -27,6 +30,25 @@
     }
   }
 
+  function hasWhitespace(value: string): boolean {
+    if (/\s/u.test(value)) return true;
+
+    try {
+      return /\s/u.test(decodeURIComponent(value));
+    } catch {
+      return true;
+    }
+  }
+
+  function hasUnsupportedProtocol(value: string): boolean {
+    const explicitProtocol = value.match(/^([a-z][a-z\d+.-]*):\/\//i);
+    if (explicitProtocol) {
+      return !['http', 'https'].includes(explicitProtocol[1].toLowerCase());
+    }
+
+    return /^[a-z][a-z\d+.-]*:(?!\d)/i.test(value);
+  }
+
   function submitLogin() {
     error = '';
     const normalized = normalizeServer(server);