fix: resolve final workbench re-review findings

apps/web/src/features/auth/ServerLogin.svelte

@@ -18,10 +18,19 @@
     }
 
     const candidate = /^https?:\/\//i.test(value) ? value : `http://${value}`;
+    if (!/^https?:\/\/(?![\\/])/i.test(candidate) || hasCredentials(candidate)) {
+      return { error: 'Enter a valid HTTP or HTTPS server address.' };
+    }
 
     try {
       const parsed = new URL(candidate);
-      if (!parsed.hostname || parsed.username || parsed.password || !['http:', 'https:'].includes(parsed.protocol)) {
+      if (
+        !parsed.hostname ||
+        parsed.username ||
+        parsed.password ||
+        !['http:', 'https:'].includes(parsed.protocol) ||
+        !isValidHostname(parsed.hostname)
+      ) {
         return { error: 'Enter a valid HTTP or HTTPS server address.' };
       }
       return { apiBase: candidate };
@@ -49,6 +58,21 @@
     return /^[a-z][a-z\d+.-]*:(?!\d)/i.test(value);
   }
 
+  function hasCredentials(value: string): boolean {
+    const authority = value.replace(/^https?:\/\//i, '').split(/[/?#]/, 1)[0];
+    return authority.includes('@');
+  }
+
+  function isValidHostname(hostname: string): boolean {
+    if (hostname === 'localhost') return true;
+    if (/^\[[\da-f:.]+\]$/i.test(hostname)) return true;
+    if (/^\d+(?:\.\d+){3}$/.test(hostname)) {
+      return hostname.split('.').every((segment) => Number(segment) <= 255);
+    }
+
+    return hostname.split('.').every((label) => /^[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?$/i.test(label));
+  }
+
   function submitLogin() {
     error = '';
     const normalized = normalizeServer(server);