harden: isSafeDuesUrl requires literal https:// so app and DB CHECK agree

Edge URLs like https:example.com parse to protocol https: but lack //,
which the migration-050 CHECK rejects -- the admin would see a confusing
save failure instead of a clear validation error. Require the prefix so
the Zod boundary matches the data layer. Fail-closed either way; no
security impact.

__tests__/dues-payments-logic.test.ts

@@ -48,4 +48,12 @@ describe('isSafeDuesUrl', () => {
     expect(isSafeDuesUrl('paypal.me/x')).toBe(false)
     expect(isSafeDuesUrl('')).toBe(false)
   })
+
+  it('rejects https without // (stays in lockstep with the DB CHECK)', () => {
+    // these parse to protocol https: but lack the // the DB CHECK requires
+    expect(isSafeDuesUrl('https:example.com')).toBe(false)
+    expect(isSafeDuesUrl('https:/x')).toBe(false)
+    // bare scheme with no host
+    expect(isSafeDuesUrl('https://')).toBe(false)
+  })
 })