Fix vault allowed origins when domain changes

[steve-wecompare]

Summary

• Normalize vault item domains before deriving allowed origins so URL input does not produce https://https://....
• Recompute allowedOrigins when an item domain is edited, including clearing origins when the domain is cleared.
• Preserve explicitly provided allowedOrigins when callers pass them.

Tests

• npm run check
• DOCKER_HOST=unix:///Users/dagobotduck/.colima/default/docker.sock TESTCONTAINERS_RYUK_DISABLED=true npx vitest run tests/integration/vaults.test.ts
• DOCKER_HOST=unix:///Users/dagobotduck/.colima/default/docker.sock TESTCONTAINERS_RYUK_DISABLED=true VAULT_ENCRYPTION_KEY=<32-byte-base64> npm test