fix: close catalog review gaps

backend/src/routes/catalog-databases.ts

@@ -1,6 +1,7 @@
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 import { isPrincipalContext, requirePermission } from "../auth/authorization.js";
+import { parseCredentialFreeHttpUrl } from "../auth/url-policy.js";
 import { CatalogService, type CatalogSecretName } from "../catalog/service.js";
 import { WorkspaceRegistryError } from "../workspaces/git-repository.js";
 import {
@@ -26,7 +27,9 @@ const bindingSchema = z.object({
   host: optionalText,
   port: port.optional(),
   username: optionalText,
-  baseUrl: z.url().max(2048).optional(),
+  baseUrl: z.string().max(2048)
+    .refine((value) => parseCredentialFreeHttpUrl(value) !== undefined)
+    .optional(),
   restPath: z.string().regex(/^\/(?!\/)[^?#\\\u0000-\u001f]*$/).max(512).optional(),
   restAuth: z.enum(["none", "bearer", "x-api-key"]).optional(),
   tlsServername: optionalText,
@@ -209,7 +212,7 @@ export function catalogDatabaseRoutes(
       const database = await deps.repository.get(id);
       if (!database) return reply.code(404).send({ code: "database_not_found", message: "Database configuration was not found." });
       if (database.version !== version) return reply.code(409).send({ code: "database_stale", message: "Database configuration changed. Reload and try again." });
-      const tested = await deps.repository.recordTest(id, version, await deps.service.test(database));
+      const tested = await deps.service.test(database);
       if (!tested) return reply.code(409).send({ code: "database_stale", message: "Database configuration changed. Reload and try again." });
       return { ...tested, configured: true, secrets: deps.service.configuredSecrets(tested.workspaceId) };
     } catch (error) { return safeError(reply, error); }