fix(browser): normalize a bare [::1] address-bar entry to http://

[dormouse-bot]

normalizeNavUrl extracts the hostname from a schemeless authority with authority.split(':', 1)[0], which returns [ for a bracketed IPv6 literal — every colon in [::1] is part of the address, not a port separator. So isLoopbackHostname('[') is false and a bare [::1] typed in the browser address bar is normalized to https://[::1], which just SSL-errors. The fix pulls the host through the closing bracket instead, keeping the exact form isLoopbackHostname already lists.

Verified by the added test, which fails on main (expected 'https://[::1]' to be 'http://[::1]') and passes with the fix.

Scope and why it was invisible

isLoopbackHostname explicitly enumerates both '::1' and '[::1]', so handling the bracketed form is the documented intent — the authority parsing is what defeats it. Only the no-port case was broken: [::1]:5173 already resolved to http via the /:\d+$/ port branch, which is why the existing loopbackPort('http://[::1]:8080/') test passes and nothing caught this. loopbackPort itself was never affected — it goes through new URL, whose .hostname is already unbracketed.

The regression test pins all three forms ([::1], [::1]/app?q=1, [::1]:5173) plus a non-loopback literal ([2001:db8::1] → https) so the bracket handling can't be loosened into "all IPv6 is loopback".

Ran: browser-url.test.ts (18 passed), the full src/components/wall suite (23 files, 274 passed), and tsc --noEmit clean.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	bba7ffd
Status:	✅  Deploy successful!
Preview URL:	https://fc9c18e0.mouseterm.pages.dev
Branch Preview URL:	https://fix-nav-url-bracketed-ipv6.mouseterm.pages.dev

View logs