[Sciscito]

Closes #18.

Adds validateUrl tests in test/server.test.mjs (node:test + node:assert/strict), as the issue lists:

• look-alike hosts: youtube.com.evil.test, evilyoutube.com, notyoutube.com
• userinfo URLs: youtube.com@evil.test, user:pass@youtube.com, user@youtube.com
• non-http(s) schemes: file:, ftp:, javascript:, data:, mailto:, ws:
• IP-literal hosts (IPv4 and IPv6)
• uppercase hosts (accepted after normalisation) and trailing dots (rejected)
• a valid subdomain (m.youtube.com, m.youtube-nocookie.com)
• a host added through FLUX_EXTRA_SOURCE_HOSTS (loaded through a fresh module instance, since the variable is read at import)

Only new tests; existing code and tests are unchanged. No bypass was found: every case behaves as the allowlist intends.

Checks. node --test test/server.test.mjs passes. I did not run the full npm test nor npm run format:check locally: the sandbox lacked the media tools some other tests need. The new code follows the file's existing style (double quotes, trailing commas); happy to adjust if format:check complains.

AI disclosure. These tests were written by free AI models (NVIDIA Nemotron through OpenRouter) running in a Kickswarm private hive, which split the issue into small tasks and kept only versions passing the test file, in a throwaway GitHub Actions sandbox. I reviewed the result and removed unrelated formatting changes before opening this PR. I am responsible for it.

[10k11]

Thanks @Sciscito, nice work on the tests and the clear AI disclosure. Everything passed and I found no bypass. The only blocker was a Prettier formatting nit in one assert.throws, which I pushed to your branch (f91d31e) so CI would go green. Merged!