fix(web): use exact Stripe URL host check

[kilo-code-bot]

Summary

• Replace the substring-based Stripe endpoint check in external-services.test.ts with exact URL hostname comparison.
• Address CodeQL alert 267 for incomplete URL substring sanitization without changing soft-delete behavior.

Verification

N/A - test-only CodeQL assertion update with no manual UI flow.

Visual Changes

N/A

Reviewer Notes

Targeted Jest verification was not run because Docker is unavailable in this container, so the test database status could not be verified per repo instructions. Formatting was limited to the touched file as requested.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Single test-only change correctly replaces .includes() substring check with new URL().hostname comparison for Stripe URL detection, addressing CodeQL alert 267 with no runtime risk since all mocked fetch calls use valid full HTTPS URLs.

Files Reviewed (1 file)

• apps/web/src/lib/external-services.test.ts

Other Observations (not in diff)

Other fetch URL checks in this file (lines 258–261, 318–321) still use .includes() for ingest.kilosessions.ai matching — these are outside the diff scope and are checking path structure (not just hostname), so they are not equivalent to the Stripe fix, but could be tightened similarly in a follow-up if desired.

---

_{Reviewed by claude-4.6-sonnet-20260217 · 496,924 tokens}

_{Review guidance: REVIEW.md from base branch main}