P0: Add unit tests for URL normalization

[devcodex2025]

Source: docs/GROWTH_AND_AGENT_BACKLOG.md

Area: Input validation testing
Priority: P0
Owner type: agent or human contributor
Files likely affected: server.js or shared URL utility, tests

Goal:
Cover malformed URLs, IDNs, redirects, unsupported protocols, and whitespace cases.

Acceptance criteria:

• Implementation matches the backlog goal.
• Tests are added or a clear reason is documented if tests are not applicable.
• User-facing errors or recommendations are actionable and do not leak secrets.
• Documentation/API notes are updated when behavior changes.

Risk:
Medium. Keep the change scoped and avoid unrelated refactors.