fix: harden onboarding completion

packages/definitions/src/test/api-key-url.spec.ts

@@ -51,8 +51,30 @@ describe("getIntegrationApiKeyUrl", () => {
     },
   );
 
-  it("returns null for empty URL", () => {
-    expect(getIntegrationApiKeyUrl("", "sonarr")).toBeNull();
+  it.each(["", "javascript:alert(1)", "data:text/html,test", "file:///etc/passwd"])(
+    "returns null for an empty or unsafe URL: %s",
+    (url) => {
+      expect(getIntegrationApiKeyUrl(url, "sonarr")).toBeNull();
+    },
+  );
+
+  it.each([
+    ["sonarr.local:8989", "http://sonarr.local:8989/settings/general"],
+    ["0.0.0.0:8989", "http://0.0.0.0:8989/settings/general"],
+  ])("normalizes a self-hosted address without a scheme: %s", (url, expected) => {
+    expect(getIntegrationApiKeyUrl(url, "sonarr")).toBe(expected);
+  });
+
+  it("joins onto a reverse-proxy pathname without retaining stale query or fragment state", () => {
+    expect(getIntegrationApiKeyUrl("https://home.example.com/services/sonarr/?from=old#section", "sonarr")).toBe(
+      "https://home.example.com/services/sonarr/settings/general",
+    );
+  });
+
+  it("preserves configured credential fragments while joining pathnames", () => {
+    expect(getIntegrationApiKeyUrl("https://home.example.com/services/jellyfin/", "jellyfin")).toBe(
+      "https://home.example.com/services/jellyfin/web/index.html#!/dashboard/keys",
+    );
   });
 
   it("strips trailing slash from base URL", () => {

packages/definitions/src/test/integration-url-template.spec.ts

@@ -34,6 +34,15 @@ describe("buildIntegrationUrl", () => {
     );
   });
 
+  it("builds reverse-proxy path URLs and preserves the configured base path", () => {
+    expect(buildIntegrationUrl("sonarr", "https://home.example.com/services", "path")).toBe(
+      "https://home.example.com/services/sonarr",
+    );
+    expect(buildAppUrl("My Service", "home.lan/apps/", "path", 9999)).toBe(
+      "http://home.lan/apps/my-service",
+    );
+  });
+
   it("replaces a supplied base port instead of producing a double port", () => {
     expect(buildIntegrationUrl("sonarr", "https://home.example.com:8443/homarr", "hostPort")).toBe(
       "http://home.example.com:8989",