fix(mcp): reject normalized base paths

apps/nextjs/src/env.spec.ts

@@ -14,6 +14,8 @@ describe("BASE_URL", () => {
     "ftp://homarr.example.com",
     "https://user:password@homarr.example.com",
     "https://homarr.example.com/prefix",
+    "https://homarr.example.com/.",
+    "https://homarr.example.com/a/..",
     "https://homarr.example.com?preview=1",
     "https://homarr.example.com#preview",
   ])("rejects the non-origin URL %s", (value) => {

apps/nextjs/src/env.ts

@@ -1,9 +1,11 @@
 import { createBooleanSchema, createEnv } from "@homarr/core/infrastructure/env";
 import { z } from "zod/v4";
 
+const httpOriginRegex = /^https?:\/\/[^/?#\\]+\/?$/i;
+
 export const baseUrlSchema = z.url({ protocol: /^https?$/ }).refine((value) => {
   const url = new URL(value);
-  return !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash;
+  return httpOriginRegex.test(value) && !url.username && !url.password;
 }, "BASE_URL must be an HTTP(S) origin without credentials, a path, query parameters, or a fragment");
 
 export const env = createEnv({