fix(channels): validate Buzz relay host

[RerankerGuo]

Why

BuzzChannel previously validated relay_url with a string-prefix check.
Values such as ws://, wss://, and ws:///missing-host passed construction
even though they have no hostname.

That leaves workspace_id empty and lets start() launch a relay task that can
only fail and reconnect forever. Invalid configuration should fail immediately
with the same actionable validation error used for non-WebSocket URLs.

What changed

• Parse the relay URL once during channel construction.
• Require a ws or wss scheme and a non-empty hostname.
• Reuse the parsed URL when deriving the workspace identity.
• Extend config validation coverage with three hostless WebSocket forms.

Valid relay paths, query strings, ports, and existing workspace identities are
unchanged.

Surface area

• Frontend UI - page / component / setting / interaction under frontend/
• Backend API - endpoint / request-response shape under backend/app
• Agents / LangGraph - agent node, graph wiring, or prompt change
• Sandbox - docker/ or sandboxed execution
• Skills - change under skills/
• Dependencies - new/upgraded dependency
• Default behavior change - invalid hostless Buzz URLs now fail fast
• Docs / tests / CI only

Screenshots / Recording

Not applicable.

Bug fix verification

• Red on main: HTTPS was rejected, but all three hostless WebSocket forms
  were accepted (1 passed, 3 failed).
• Green after the fix: Buzz suites pass (142 passed).

Validation

• cd backend && PYTHONPATH=. uv run --extra buzz pytest tests/test_buzz_channel.py tests/test_buzz_nostr.py -q - 142 passed
• cd backend && make test with the Buzz extra installed -
  11205 passed, 72 skipped
• Focused Ruff lint and format checks passed
• git diff --check passed

Duplicate check

Searched open issues and PRs for Buzz relay URL, WebSocket host, and invalid URL
validation; no active report or implementation was found.

AI assistance

Tool(s) used: TRAE

How you used it: Audited the newly merged Buzz connector, wrote the
parameterized failing configuration test first, implemented the minimal
constructor validation, and ran focused plus full validation. I reviewed the
final diff and can explain each changed line.

• I've read and understand every line of this change and take responsibility for it - it's not unreviewed AI output.