fix: resolve workbench final review findings

apps/web/src/features/auth/ServerLogin.svelte

@@ -6,25 +6,44 @@
   let account = '';
   let password = '';
   let error = '';
+  let connectionStatus = 'Not connected. Enter a server address to continue.';
 
-  function normalizeServer(value: string) {
+  function normalizeServer(value: string): { apiBase?: string; error?: string } {
     const trimmed = value.trim();
-    if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {
-      return trimmed;
+    if (!trimmed) {
+      return { error: 'Enter a server address.' };
+    }
+
+    const candidate = /^https?:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`;
+
+    try {
+      const parsed = new URL(candidate);
+      if (!parsed.hostname || !['http:', 'https:'].includes(parsed.protocol)) {
+        return { error: 'Enter a valid HTTP or HTTPS server address.' };
+      }
+      return { apiBase: candidate };
+    } catch {
+      return { error: 'Enter a valid HTTP or HTTPS server address.' };
     }
-    return `http://${trimmed}`;
   }
 
   function submitLogin() {
     error = '';
+    const normalized = normalizeServer(server);
+    if (normalized.error) {
+      error = normalized.error;
+      connectionStatus = 'Check the server address before signing in.';
+      return;
+    }
+
     if (!account.trim() || !password.trim()) {
       error = 'Enter an account and password.';
       return;
     }
 
-    const normalized = normalizeServer(server);
-    server = normalized;
-    onLogin({ apiBase: normalized, account: account.trim() });
+    server = normalized.apiBase ?? server;
+    connectionStatus = 'Connection settings are ready.';
+    onLogin({ apiBase: server, account: account.trim() });
   }
 </script>
 
@@ -56,6 +75,8 @@
         <p class="form-error" aria-live="polite">{error}</p>
       {/if}
 
+      <p class="connection-status" role="status">{connectionStatus}</p>
+
       <button type="submit">Log in</button>
       <p class="login-note">The server address is remembered on this device.</p>
     </form>