fix: reject alias endpoints with path components

[overtrue]

Summary

• Reject alias endpoint URLs that include path, query, or fragment components
• Keep plain host/port HTTP(S) endpoints accepted
• Add regression coverage for the rejected endpoint shapes

Test Plan

• cargo fmt --all --check
• cargo clippy --workspace -- -D warnings
• cargo test --workspace
• Manual check: rc alias set bad http://127.0.0.1:9000/api access secret now exits with usage error and does not save the alias

[Copilot]

Pull request overview

This PR tightens alias endpoint validation to reject HTTP(S) URLs that include path, query, or fragment components, ensuring aliases represent a plain service root endpoint, and adds regression tests for the rejected URL shapes.

Changes:

• Add validation to reject endpoints containing non-root paths, query strings, or fragments.
• Reuse the stricter validation for both direct alias endpoints and RC_HOST_* env alias parsing.
• Add a unit test covering path/query/fragment rejection cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.