feat(worker): adopt canonical public URL

docs/architecture.md

@@ -78,10 +78,14 @@ provided by a validated control-plane task.
   Raft, and closes SQLite without exceeding the service stop timeout.
 - A web-console failure is reported and causes an intentional process policy;
   it must not silently leave a partially healthy process.
-- Startup currently rejects malformed `WORKER_URL`; the accepted target is
-  `PUBLIC_URL` with bounded compatibility migration. Startup also rejects
-  incomplete auth credentials, invalid cluster settings, and unwritable data
-  directories before accepting work.
+- Startup validates the advertised origin: canonical `PUBLIC_URL` is held to
+  the strict scheme-and-authority shape (no userinfo, query, fragment, or
+  ambiguous path) and plain HTTP on a non-loopback host is rejected in an
+  explicitly production environment; the legacy `WORKER_URL` is read as a
+  bounded-migration fallback, held only to the tolerant absolute-URL check,
+  and logged with a deprecation warning. Both reject a missing hostname, e.g.
+  `https://:27401`. Startup also rejects incomplete auth credentials, invalid
+  cluster settings, and unwritable data directories before accepting work.
 - `GET /healthz` reports process-local liveness. Control-plane reachability is
   a separate readiness/selfcheck signal and must not make a healthy container
   fail its local liveness probe.