security: fix Solid server auto-trust hostname matching

Replace String.includes() with exact hostname matching via URL parsing.
The previous substring check allowed malicious domains containing the
trusted substring to pass (e.g. evil-solid.social.attacker.com matched
solid.social). Now uses new URL().hostname with exact match or subdomain
check (hostname.endsWith('.' + trusted)). Also removes the never-matching
'/.well-known/solid' entry since origins don't contain paths.

Co-Authored-By: claude-flow <ruv@ruv.net>

Author: DreamLab-AI Mega-Sprint

src/background.js

@@ -330,16 +330,23 @@ function encodeNip98Header (signedEvent) {
  * @returns {boolean}
  */
 function isLikelySolidServer (origin) {
-  // Common Solid server indicators
-  const solidIndicators = [
+  let hostname;
+  try {
+    hostname = new URL(origin).hostname;
+  } catch {
+    return false;
+  }
+
+  const trustedHosts = [
     'solid.social',
     'solidcommunity.net',
     'inrupt.net',
-    'solidweb.org',
-    '/.well-known/solid'
+    'solidweb.org'
   ];
 
-  return solidIndicators.some(indicator => origin.includes(indicator));
+  return trustedHosts.some(trusted =>
+    hostname === trusted || hostname.endsWith('.' + trusted)
+  );
 }
 
 async function createNip98AuthHeader (url, method, body = null) {