fix(security): parse and compare hostname instead of substring match in Adobe Firefly login

Replace request.url.includes(FIREFLY_3P_HOST_SUFFIX) with parsed-hostname
comparison (anchored endsWith), closing CodeQL alert #778.

The old substring check could be bypassed by an attacker-controlled page
visited during the browser login window — a URL like
'https://evil.com/firefly-3p.ff.adobe.io' would pass the gate and its
Bearer token would be captured as the Adobe credential.

Practical severity is low (only during operator-initiated, time-boxed
login on a temp-profile browser), but the fix is one line and matches
the dot-anchored idiom used in docker/devin-bridge/network-guard/.

Closes code-scanning #778.

open-sse/services/adobeFireflyBrowserLogin.ts

@@ -259,7 +259,14 @@ async function captureViaCdp(opts: {
       if (capturedAccessToken) return;
       const request = params.request as
         { url?: string; headers?: Record<string, string> } | undefined;
-      if (!request?.url || !request.url.includes(FIREFLY_3P_HOST_SUFFIX)) return;
+      if (!request?.url) return;
+      let host: string;
+      try {
+        host = new URL(request.url).hostname.toLowerCase();
+      } catch {
+        return;
+      }
+      if (host !== FIREFLY_3P_HOST_SUFFIX && !host.endsWith(`.${FIREFLY_3P_HOST_SUFFIX}`)) return;
       const headers = request.headers || {};
       const auth = headers.Authorization || headers.authorization || headers.AUTHORIZATION || "";
       const token = extractAdobeBearerTokenFromAuthorization(auth);