fix(frontend): bind session tokens to backend transport

[MyButtermilk]

Summary

• preserves the existing default-port normalization from the Claude Code review
• requires the candidate URL to use the same transport family as the configured backend: http/ws or https/wss
• prevents a session token from being attached to a same-host, same-port URL that crosses between secure and insecure transports
• extracts backend endpoint matching into a small pure helper while keeping authenticated-path checks and token mutation at the existing backend authentication boundary
• adds focused regression coverage for default ports, transport families, hostnames, ports, and unsupported protocols

Review of the linked suggestions

The linked Claude session maps to commit 4fed456e3e30a51af644f3fdbbb3cd677a3f1fe2, which is already an ancestor of main.

• Default-port normalization: approved and retained. The original implementation compared host and effective port but did not distinguish secure from insecure transports. This PR closes that remaining token-scoping gap.
• Shared response-detail parser: approved and already present on main; no duplicate change.
• Shared process helpers: approved and already present on main; no duplicate change.
• PySide6/tkinter overlay fallback: historically reasonable, but obsolete because the current runtime uses the native Tauri overlay and the legacy module has been removed.
• Collapsing the lazy pipeline loader: not reapplied. Current main has import locking, off-event-loop construction, deferred cache cleanup, and explicit cancellation ownership that the old simplification would weaken.

Security boundary

Session-token mutation remains limited to authenticated backend paths (/api/* and /ws). Endpoint matching now fails closed unless hostname, effective port, and transport security family all agree. HTTP and WebSocket variants are paired only within the same family (http with ws, https with wss); unsupported protocols are rejected.

Validation

• focused TypeScript/Node regression tests for default ports, HTTP/WebSocket pairing, secure/insecure rejection, host/port scoping, and unsupported protocols
• frontend typecheck, lint, tests, and production build
• focused Python hybrid gates
• repository-wide Ruff lint and formatting checks
• complete Python suite, real-browser File-upload smoke, and extended mypy tranche
• Rust formatting, Clippy, and tests
• GitHub Actions workflow syntax

Hybrid PR Checks run 328 completed successfully for head ff297d6ddb1e4c5998cf303d56657f1b6b5a6798.