fix: harden assistant authoring and UI

apps/nextjs/src/components/assistant/assistant-url.ts

@@ -0,0 +1,11 @@
+export const getSafeAssistantHttpUrl = (source: unknown) => {
+  if (typeof source !== "string" || !source) return null;
+
+  try {
+    const url = new URL(source);
+    if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username || url.password) return null;
+    return url.toString();
+  } catch {
+    return null;
+  }
+};