fix(dispatch): hub_relay 推送目标改绑定设备 id + MCP URL 真校验

[DeliciousBuding]

范围（安全探索 lane F12/F15）

• F15 功能 bug：dispatchRouteHubRelay 原来把 InviterUserID 当 PushToDevice 的键——byDevice 以 device_id 建键，hub_relay 活推送每次静默 miss，任务只能靠 outbox 重试。改为传 task.EdgeDeviceID（空值保留 inviter 回退）；测试记录 target id 并断言 dev-1 + 新增回退用例。
• F12（P2）：MCPServer.Validate 的 URL 校验从子串匹配升级为 url.Parse——强制 http/https、必须有 host、拒绝 userinfo/凭据参数；新增 ftp / 无 host / 裸主机名三用例。

验证

• go test model / dispatchsvc / handler 三包全绿
• go vet 绿；git diff --check 干净

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: c3a6b724-3da4-4e62-8f6f-35fc2a1d69f2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}