CON-45: no plaintext ws:// for a host that merely starts with localhost

[molgerz]

Closes CON-45. From the CON-43 security audit.

host.startsWith('localhost') is true for localhost.evil.example — a name anyone can register. Such a host got an unencrypted ws:// connection, and because the host comes out of the route, whoever writes a space link picks it. NostrClient signs a NIP-42 AUTH event on connect, so that put the signed-in user's pubkey on the wire in the clear.

What is in it

• The rule is anchored and lives in one exported predicate (isLocalRelayHost), so the trust gate in CON-46 asks the same question instead of keeping a second inline copy of the condition — which is how this bug started. [::1] joins the local set.
• The predicate normalises before it decides, rather than assuming a validated host: on the bare regex localhost:99999, localhost:65536 and localhost:00000 are "local", and a caller would pick plaintext for a host no connection can be made to.
• The host is validated by round-tripping it through URL: whatever the platform's parser reads as the host is what a connection would go to, so anything that makes input and parse disagree is rejected — evil.example/#@real-relay.example, paths, queries, userinfo, whitespace, out-of-range ports.
• One exception, deliberate: a written-out :443 survives. URL drops it as https' default port, but a local host carries its port into a ws:// URL where :443 is not the default — and my-spaces.ts and CreateSpaceForm.tsx derive a host by stripping the scheme off DEFAULT_RELAY_URL, so a deployment whose VITE_RELAY_URL spells the port out produces exactly that shape. A padded :0443 is still rejected.
• The second decodeURIComponent is gone: React Router decodes path params before useParams, so it was a decoder with no matching encoder — a group id ending in % threw URIError out of render (white screen), and a double-encoded link decoded back into a host the address bar never showed.

How to test

1. Open /s/localhost.evil.example'engineering (no such relay needs to exist) and check in DevTools → Network that the attempted WebSocket is wss://, not ws://. Same for localhost.evil.example:8080.
2. The real dev relay still connects over ws:// (localhost:8080, 127.0.0.1:8080, [::1]:8080).
3. /s/evil.example/#@real-relay.example'group, a host with a path, a query or a port above 65535: the address is refused rather than connected to.
4. A group id ending in % renders an error instead of a white screen.
5. src/nostr/group-address.test.ts covers the whole table.