Keep web app launchers on http(s)

Chromium --app= will run javascript:, file:, and data: URLs. Prefix
schemeless input with https as before, then refuse anything else.

bin/omarchy-webapp-install

@@ -42,6 +42,27 @@ download_icon() {
     [[ -s $2 && $(file -b --mime-type "$2") == image/* ]]
 }
 
+# Chromium --app= treats javascript:, file:, and data: as a document to
+# run. Prefix schemeless input with https as before, then refuse anything
+# that is not http(s). Desktop-file value escaping is a separate concern
+# (see open work on the freedesktop string/Exec rules).
+normalize_webapp_url() {
+  local url=$1
+  if [[ ! $url =~ ^[a-zA-Z][a-zA-Z0-9+.-]*: ]]; then
+    url="https://$url"
+  fi
+  printf '%s' "$url"
+}
+
+require_http_url() {
+  local url=$1
+  if [[ $url =~ ^https?:// ]]; then
+    return 0
+  fi
+  echo "Error: web app URL must be http or https." >&2
+  exit 1
+}
+
 fetch_site_icon() {
   local site_url="$1" dest="$2"
   local origin page icon_url
@@ -69,9 +90,7 @@ if (( $# < 3 )); then
   echo -e "\e[32mLet's create a new web app you can start with the app launcher.\n\e[0m"
   APP_NAME=$(gum input --prompt "Name> " --placeholder "My favorite web app")
   APP_URL=$(gum input --prompt "URL> " --placeholder "https://example.com")
-  if [[ ! $APP_URL =~ ^[a-zA-Z][a-zA-Z0-9+.-]*: ]]; then
-    APP_URL="https://$APP_URL"
-  fi
+  APP_URL=$(normalize_webapp_url "$APP_URL")
 
   # Try to fetch the site's icon automatically first.
   mkdir -p "$ICON_DIR"
@@ -88,10 +107,7 @@ if (( $# < 3 )); then
   INTERACTIVE_MODE=true
 else
   APP_NAME="$1"
-  APP_URL="$2"
-  if [[ ! $APP_URL =~ ^[a-zA-Z][a-zA-Z0-9+.-]*: ]]; then
-    APP_URL="https://$APP_URL"
-  fi
+  APP_URL=$(normalize_webapp_url "$2")
   ICON_REF="$3"
   CUSTOM_EXEC="$4" # Optional custom exec command
   MIME_TYPES="$5"  # Optional mime types
@@ -104,6 +120,8 @@ if [[ -z $APP_NAME || -z $APP_URL ]]; then
   exit 1
 fi
 
+require_http_url "$APP_URL"
+
 if [[ -z $ICON_REF ]]; then
   ICON_VALUE=$(safe_icon_name "$APP_NAME")
   mkdir -p "$ICON_DIR"