fix: validate mcp.issuer is a full origin at config load (#139)

[heskew]

Summary

Turns the "pin a full origin" documentation convention for mcp.issuer into an enforced invariant. When mcp.issuer is set, updateConfiguration now validates it is an absolute http(s) origin — parseable by new URL(), http: or https: scheme, no path (beyond a trailing slash), no query, no fragment — and throws a clear error otherwise.

The existing presence check (mcp.enabled && !mcp.issuer) is unchanged.

Why origin-only

resolveIssuer returns mcpConfig.issuer verbatim (minus trailing slash). buildAuthorizationServerMetadata prefixes every endpoint URL with it (${issuer}/oauth/mcp/authorize, etc.). protectedResourceMetadataUrl calls new URL(resolveResource(...)). A path-bearing value like https://host/base would silently produce https://host/base/oauth/mcp/authorize — not the correct path shape — and a schemeless value like as.example.com would throw inside new URL() at request time rather than at startup.

Validation logic

let parsedIssuer: URL;
try { parsedIssuer = new URL(mcpConfig.issuer); } catch { throw ... }
if (protocol !== 'http:' && protocol !== 'https:') throw ...;
const stripped = parsedIssuer.pathname.replace(/\/+$/, '');
if (stripped !== '' || parsedIssuer.search !== '' || parsedIssuer.hash !== '') throw ...;

Trailing slash tolerated — resolveIssuer already strips it.

Tests added (test/options-watcher.test.js)

• https://app.example.com → passes
• http://localhost:9926 → passes
• https://app.example.com/ (trailing slash) → passes
• as.example.com (schemeless) → throws with mcp.issuer must be an absolute http(s) origin
• https://app.example.com/base (path-bearing) → throws

Pre-existing cases (enabled+no-issuer, resource-only-pinned) unchanged.

Closes #139

🤖 Generated with Claude Code — Claude Sonnet 4.6

[gemini-code-assist]

Code Review

This pull request adds validation for the mcpConfig.issuer option to ensure it is a valid absolute http(s) origin without paths, queries, or fragments, along with corresponding unit tests. The reviewer suggested refactoring the validation logic to avoid duplicating the error message across multiple checks.

[claude]

Reviewed; no blockers found.

[github-actions]

Reviewed; no blockers found. Prior 1 finding resolved by e0c11cd.