* fix(doubao-web): switch provider to Dola global
* fix(doubao-web): use .dola.com cookie domain for s_v_web_id + rebaseline test
The Dola switch left s_v_web_id with a host-only "www.dola.com" domain, which fails
the token-source contract (domain must start with "." or "http") — the sibling
sessionid/ttwid cookies and the canonical cookieDomain already use ".dola.com", which
also matches www.dola.com. Also rebaselines web-cookie-providers-new.test.ts (850->890)
for the provider-switch regression cases.
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Replace `result.url.includes("poe.com")` / `.includes("doubao.com")` with a
parsed `new URL(result.url).hostname` check that accepts the exact host or a
legitimate subdomain (`.endsWith(".poe.com")`). The substring form also matches
hostile URLs like `https://evil.com/?x=poe.com`, which CodeQL flags as
js/incomplete-url-substring-sanitization (2 high-severity alerts on PR #2930).
This strengthens the assertion rather than masking it — the executors build
`https://www.poe.com` / `https://www.doubao.com`, both still satisfied.
