Stickies Android android-20260731130935

fix(room): a URL wrapped in punctuation is no longer a broken link (#46)

Pasting a URL with surrounding parens/brackets/quotes or trailing sentence
punctuation produced a broken clickable link: '(https://x.com)' became a link to
'https://(https//x.com)', 'https://x.com,' to a host with a trailing comma, etc.
Common when pasting a URL out of prose.

safeHref now strips wrapping pairs ((), [], <>, quotes) around the whole value,
trailing sentence punctuation (.,;:!?), and a dangling close-bracket that has no
matching opener — then parses. Conservative: parens WITH a matching opener are
kept, so a legit .../Foo_(bar) Wikipedia URL is untouched. The javascript:/data:
XSS guard is unaffected (scheme is still rejected after stripping).

Verified in-browser: '(https://example.com)' → https://example.com/ link, and a
Foo_(bar) URL keeps its parens. Adds safeHref tests for wrapping/trailing
punctuation + the paren-preserving case. 341 unit + 19 e2e pass.

Closes #73