fix(security): resolve CodeQL ReDoS + URL sanitization alerts

- Replace replace(/\/+$/, "") with explicit while-endsWith loop to avoid
  polynomial backtracking on inputs with repeated trailing slashes
  (CodeQL js/polynomial-redos #233-240, 8 alerts):
  - @omniroute/opencode-provider/src/index.ts (normalizeBaseURL)
  - bin/cli/api.mjs (stripTrailingSlash)
  - src/lib/cli-helper/config-generator/{claude,cline,codex,continue,
    kilocode,opencode}.ts (6 generators with identical pattern)

- tests/live/deepseek-web-live.test.ts: assert hostname via URL parsing
  instead of String.includes() so the check is exact-match rather than
  substring (CodeQL js/incomplete-url-substring-sanitization #241).

Alert #242 (Array.prototype.includes against fixed needle constant
OPENWEBUI_PARAGRAPH_ANCHORS) dismissed as CodeQL false-positive — not a
URL sanitization callsite.

@omniroute/opencode-provider/src/index.ts

@@ -107,7 +107,10 @@ export function normalizeBaseURL(rawBaseURL: string): string {
       `@omniroute/opencode-provider: baseURL is not a valid URL: ${JSON.stringify(rawBaseURL)}`
     );
   }
-  return trimmed.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1";
+  let base = trimmed;
+  while (base.endsWith("/")) base = base.slice(0, -1);
+  if (base.endsWith("/v1")) base = base.slice(0, -3);
+  return base + "/v1";
 }
 
 /**