fix(security): validate MB url-rel links by scheme + host, not substring (task/harden-resolver-link-validation)

relUrls() picked MusicBrainz link relations by substring (u.includes("bandcamp.com")) with
no scheme check, so a non-http(s) resource or a look-alike host (https://evilbandcamp.com,
javascript:...bandcamp.com...) could be returned and become an injected link's href. Now:
isHttpUrl() accepts http/https only, and matching is by PARSED hostname (=== host ||
endsWith "."+host). Resolver-only; extension unaffected; pure + unit-tested (18 total green).

Source: plan/steward-linker-security SCOUT 2026-06-17.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

service/lib.test.js

@@ -1,7 +1,7 @@
 // Unit tests for the resolver's pure logic (run with `node --test`). Zero-dep.
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { norm, bandcampSearch, spotifySearch, pickArtist, spotifyResult, relUrls, mbResult, primaryOf, isSearchUrl } from "./lib.js";
+import { norm, bandcampSearch, spotifySearch, pickArtist, spotifyResult, relUrls, mbResult, primaryOf, isSearchUrl, isHttpUrl } from "./lib.js";
 
 test("norm lowercases, trims, NFKC-normalizes", () => {
   assert.equal(norm("  Cerebral Bore "), "cerebral bore");
@@ -77,6 +77,27 @@ test("relUrls returns nulls when relations absent/empty", () => {
   assert.deepEqual(relUrls([]), { bandcamp: null, spotify: null });
 });
 
+test("relUrls rejects non-http(s) and look-alike hosts (hardening)", () => {
+  const relations = [
+    { url: { resource: "javascript:alert('bandcamp.com')" } }, // not http(s)
+    { url: { resource: "ftp://files.bandcamp.com/x" } }, // not http(s)
+    { url: { resource: "https://evilbandcamp.com/" } }, // host doesn't end in .bandcamp.com
+    { url: { resource: "https://x.bandcamp.com/" } }, // valid subdomain
+  ];
+  const links = relUrls(relations);
+  assert.equal(links.bandcamp, "https://x.bandcamp.com/");
+  assert.equal(links.spotify, null);
+});
+
+test("isHttpUrl accepts http/https only", () => {
+  assert.equal(isHttpUrl("https://x.com"), true);
+  assert.equal(isHttpUrl("http://x.com"), true);
+  assert.equal(isHttpUrl("javascript:alert(1)"), false);
+  assert.equal(isHttpUrl("ftp://x/y"), false);
+  assert.equal(isHttpUrl("not a url"), false);
+  assert.equal(isHttpUrl(null), false);
+});
+
 test("mbResult prefers direct links, falls back to search per-platform", () => {
   const direct = mbResult(
     { name: "Cattle Decapitation" },