fix(frontend): a page opened at a //path boots, and the account-switch copy reads right in Hungarian

Every address-bar writer glued `pathname + query`, so a path of `//evil.com/x` named another host:
history refused it (SecurityError) and the first nav mirror threw the app into its crash screen. One
builder, `hrefHere`, now makes the address from the URL itself and stays on this origin.

frontend/src/lib/urlState.dom.test.ts

@@ -100,6 +100,32 @@ describe("clearParams", () => {
   });
 });
 
+describe("a page opened at a path that starts with //", () => {
+  // Regression: the address was glued together as `pathname + query`, and a path of `//evil.com/x`
+  // then reads as a link to another host. history refuses that (SecurityError), so the first nav
+  // mirror to write threw and the app booted into its crash screen.
+  const openAt = (rest: string) =>
+    window.history.replaceState(null, "", `${window.location.origin}//evil.com/x${rest}`);
+  const origin = window.location.origin;
+
+  it("writes an address on this origin and this path", () => {
+    openAt("?page=plex#verify=t");
+    window.history.replaceState(null, "", urlWithParams({ v: "show:1" }));
+    expect(window.location.origin).toBe(origin);
+    expect(window.location.pathname).toBe("//evil.com/x");
+    expect(window.location.search).toBe("?page=plex&v=show%3A1");
+    expect(window.location.hash).toBe("#verify=t");
+  });
+
+  it("strips a transient key without leaving this origin", () => {
+    openAt("?link=ok&page=plex");
+    clearParams("link");
+    expect(window.location.origin).toBe(origin);
+    expect(window.location.pathname).toBe("//evil.com/x");
+    expect(window.location.search).toBe("?page=plex");
+  });
+});
+
 describe("filterParamUpdates", () => {
   it("maps non-default filters to values and defaults to null (delete)", () => {
     const f: FeedFilters = { ...DEFAULTS, q: "react", tags: [3, 7], show: "watched" };