fix(roe): close two target-extraction scope bypasses (URL userinfo + TLD/extension collision)

[VoidChecksum]

Summary

The RoE evaluator refuses out-of-scope hosts only for targets returned by extract_targets() (middleware/roe.py:205). Two extraction gaps let a host evade scope enforcement entirely.

1. URL userinfo bypass (security)

_URL_RE captured [^\s/:]+ immediately after ://, so curl https://user:pass@evil.example/ captured user (dropped as invalid) and the real host evil.example was never evaluated by RoE. The regex now skips an optional userinfo@ segment and captures the host, excluding @.

2. TLD / file-extension collision (security)

_NON_TARGET_EXTENSIONS dropped any token whose last label matched a file extension — but .sh .md .py .pl .pub .zip are delegated DNS TLDs, so curl https://evil.zip was silently dropped from scope enforcement. Those real-TLD entries are removed (file-only extensions retained); the stale comment claiming no TLD collides is corrected with a security rationale to prevent regression.

Both fixes err toward over-extraction, matching this module's documented "false positives are safer than false negatives" design — a spurious target is operator-overridable; a dropped real one is a silent scope breach.

Tests

New tests/unit/middleware/test_command_targets_scope_bypass.py: userinfo stripping (with port handling), TLD-colliding hosts now extracted, and confirmation that genuine local-file arguments (key.pem, scan.txt, …) stay excluded. Full existing RoE suite passes (64 tests green locally).

🤖 Generated with Claude Code

[VoidChecksum]

Closing as a duplicate. The two RoE scope-extraction fixes here (URL userinfo + real-TLD/extension collision) are now consolidated into #405, which uses a more robust RFC-3986 urlsplit-based host extraction and additionally normalizes packed-integer/hex IPv4 IMDS encodings. The TLD-collision fix + regression tests from this PR have been folded into #405. Merge #405 instead.