fix: accept bare host URLs

[chaliy]

What

Allow fetchkit web fetch requests to accept browser-like bare domain URLs such as paseo.sh/docs/custom-providers by normalizing them to https://paseo.sh/docs/custom-providers before validation and execution.

Why

Host integrations should not need wrappers for common URL input. fetchkit owns the request contract, URL validation, schema/help text, and SSRF/prefix policy enforcement.

How

• Normalize domain-like bare hosts in FetchRequest before tool, client, registry, and save-to-file execution paths.
• Preserve explicit http:// and https:// URLs as provided.
• Continue rejecting non-web schemes, protocol-relative URLs, bare IPs, and single-label local-ish names.
• Keep SSRF, DNS, port, allow-prefix, and block-prefix checks running against the canonical URL.
• Update schema/help text plus initial and threat-model specs.
• Add transport-backed regression tests for typed execute, JSON execution, policy matching, and rejection cases.

Risk

• Low
• Bare domain inputs now fetch over HTTPS instead of returning InvalidUrlScheme; callers relying on that exact rejection for domain-like inputs may need to account for the new accepted form.

Checklist

• Unit tests are passed
• Smoke tests are passed
• Documentation is updated
• Specs are up to date and not in conflict
• Formatting, clippy, tests, docs, and release build smoke passed locally