fix(config): reject hostless addresses in single-user mode

[tuzengji]

What this changes

Addresses finding 2 of #786.

With OPENBOT_SINGLE_USER=true, example.com:3010 in OPENBOT_PUBLIC_URL, OPENBOT_APP_URL or TRUSTED_ORIGINS previously passed startup with a private-network warning. new URL() interprets that value as a scheme with an empty hostname, which then matched the single-label LAN-name rule.

Classify an empty normalized hostname as public so startup refuses it. The existing loopback and private-network cases retain their behavior. Regression cases exercise all three configuration inputs through loadConfig.

Where it runs

• New state that outlives a request? None; this is startup configuration validation.
• What happens on the second replica? It independently rejects the same invalid configuration before serving requests.
• Anything serialised? None.
• Anything fanned out to a browser? None.
• New listener, port, or schedule? None.

Boundary and audit

• Every acting call still goes through the gateway: no acting-call paths change.
• New refusals and new failures each write a row: not applicable to this existing startup refusal, before a running server or audit store exists.
• Nothing new is trusted from the client: validation reads deployment configuration only.

Changelog

• Added an Unreleased note describing the startup refusal.

Proof

Revalidated on October 17 after merging main at 12c3a69. The changelog conflict is resolved with both entries retained. The 147 configuration/single-user tests, formatting, lint, type checks, and workspace builds all pass on the merged branch.

On macOS with Bun 1.4.3, invoked through npm exec --package bun@1.4.3:

• bun test server/tests/config.test.ts server/tests/single-user.test.ts: before the production fix, 144 passed and the three new cases failed because startup did not throw; afterwards, 147 passed, 0 failed.
• bun run format:check, bun run lint, bun run typecheck, bun run build: passed.
• git diff --check: passed.

The full database integration suite was not run; this change was exercised through configuration unit tests without a model, external service or database.

AI disclosure: Codex authored and tested this change, with an independent agent review of the diff and regression evidence.