fix: normalize origin URL in verify_endpoints so bare host:port probes work

The CLI accepts --endpoint 127.0.0.1:11434 (no scheme) and passes that
string through to verify_endpoints, which hands it to reqwest. Reqwest's
request builder refuses to build a request from a URL without a scheme
and returns a "builder error" — which our probe was reporting as
"origin not reachable" indefinitely:

  ✓ proxy responding (0.4s) [https://...]: HTTP 200
  … origin not reachable (0s) [127.0.0.1:11434]: builder error
  … origin not reachable (10s) [127.0.0.1:11434]: builder error
  ...

The actual origin was reachable the whole time — the proxy probe got
HTTP 200 through the tunnel back to the same host:port. Only the CLI's
local probe was wedged.

Apply lib::normalize_endpoint (the same canonicalization that
TunnelSummary.endpoint stores) at the top of verify_endpoints so any
bare host:port works as input. The displayed URL becomes the canonical
form (http://127.0.0.1:11434), matching what's stored on the HTTPProxy.

verify_endpoints is on the connect-lib side of the boundary we sketched
in datum-cloud/enhancements#756 comment 4644292554 — defensive
normalization belongs here so other callers (UI Edit dialog, the future
plugin foreground listen path) don't have to remember to canonicalize.

Author: drewr

cli/src/main.rs

@@ -1300,6 +1300,12 @@ async fn verify_endpoints(
     proxy_hostname: &str,
     budget: std::time::Duration,
 ) -> n0_error::Result<()> {
+    // The CLI accepts `--endpoint host:port` (no scheme) and uses the same
+    // normalize_endpoint that `TunnelSummary.endpoint` is canonicalized
+    // through. Without this, reqwest's request-builder rejects a bare
+    // host:port with "builder error" and the probe loops forever even
+    // though the actual origin is reachable.
+    let origin_url = lib::normalize_endpoint(origin_url);
     let proxy_url = format!("https://{proxy_hostname}/");
     let client = reqwest::Client::builder()
         // Per-request timeout shorter than the poll interval so a stuck
@@ -1317,7 +1323,7 @@ async fn verify_endpoints(
     loop {
         // Probe in parallel — skip the side that's already ready.
         let origin_fut = async {
-            if origin_ok { None } else { Some(probe(&client, origin_url).await) }
+            if origin_ok { None } else { Some(probe(&client, &origin_url).await) }
         };
         let proxy_fut = async {
             if proxy_ok { None } else { Some(probe(&client, &proxy_url).await) }