Fix client URL handling, login expiry and partial fanout results

[SummusStuprator]

Three independent client regressions can misdirect a request, keep a terminal polling after a grant expires, or produce inconsistent multi-board search results. This batch fixes each in its own commit:

• Normalize HTTP scheme case without changing path case, and recognize uppercase bare LOCALHOST. Previously HTTPS://example.test became https://HTTPS://example.test.
• Stop device polling at the advertised grant deadline, including expiry during a polling sleep. An approval received before expiry still installs the token.
• Validate a search page's item container and numeric total, and prepare its hits before appending them. A board returning [validJob, null] previously left a partial hit even though the source failed; a string total could turn the combined total into "021".

Validation: each regression was reproduced before its fix. Nine new tests; TypeScript build and all 267 tests pass on Node 24.15.0. The existing service-worker asset hash test initially failed because this Windows checkout converted shell assets to CRLF; it passes using the repository's original LF bytes. No shell content or cache version is changed in this PR. A separate .gitattributes fix will address checkout portability.

Prepared and tested by an AI coding assistant with the account owner's authorization. No live customer systems, credentials or user data were used. This does not address issues #87 or #89, which already have another contributor working on them.