Auto-review follow-ups for PR #364: fix(server,extension): refuse a public-suffix domain and a local Origin, and surface only the self-derived pair code

[github-actions]

Tracking auto-review follow-ups for #364 (verdict: warn).

🟡 Nits

• Public-suffix refusal is enforced only in validateHello at the extension, which drops the frame silently (extension-core/src/background/socket.ts:246) — validate opts.domains with isPublicSuffix in the FetchproxyServer constructor (ws-server.ts:1436) and in packages/cli/src/profiles.ts so a bad domain fails loud at boot instead of timing out with the 'sign in' hint

---

Checklist regenerated from the auto-review of 21bbdd4 (run). Ticks survive later rounds, but a round that reviewed an older commit can still re-list something already fixed — check that SHA before redoing an item.

When addressing the review on #364, resolve each item and add Closes #<this issue> to the PR once everything is genuinely fixed; deferred items stay open here. See the auto-review follow-up convention in CLAUDE.md.