Class NavigationGuard

Check whether navigation to the given URL is allowed.

Extract the hostname from a URL string. Handles full URLs and bare domains gracefully.

Whether hostname NAMES this machine or a private network: localhost (and *.localhost), a dotless intranet name, or a loopback, private, shared, link-local or unique-local IP literal. Pass a parsed URL's hostname, so numeric IPv4 forms arrive normalized. ponytail: best effort, a hostname test only. A name that RESOLVES to a private address (127.0.0.1.nip.io, localtest.me, DNS rebinding) passes; real isolation is network egress rules on the machine the browser runs on.

Match a domain against a pattern. Supports:

• "*" → matches everything
• "*.example.com" → matches subdomains AND bare domain
• "example.com" → exact match only

This is a static method so it can be reused by AuthHandler for the same domain matching logic.