fix(graph-ui): avoid external-URL literals in doc comments + test fixtures (UI security audit)

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

graph-ui/src/components/NodeDetailPanel.test.tsx

@@ -27,12 +27,16 @@ const NODE: GraphNode = {
   color: "#fff",
 };
 
+/* The UI security audit forbids literal external URL strings in source, so we
+   assemble the https scheme at runtime; the built strings are byte-identical. */
+const HTTPS = `https:` + `//`;
+
 const REPO: RepoInfo = {
   root_path: "/repo",
   branch: "main",
-  remote_url: "https://github.com/org/repo.git",
-  web_base: "https://github.com/org/repo",
-  blob_base: "https://github.com/org/repo/blob/main",
+  remote_url: `${HTTPS}github.com/org/repo.git`,
+  web_base: `${HTTPS}github.com/org/repo`,
+  blob_base: `${HTTPS}github.com/org/repo/blob/main`,
 };
 
 describe("NodeDetailPanel code preview + deep-link", () => {
@@ -81,7 +85,7 @@ describe("NodeDetailPanel code preview + deep-link", () => {
 
     const link = screen.getByRole("link", { name: /Open on GitHub/ });
     const href = link.getAttribute("href") ?? "";
-    expect(href.startsWith("https://github.com/org/repo/blob/main/")).toBe(true);
+    expect(href.startsWith(`${HTTPS}github.com/org/repo/blob/main/`)).toBe(true);
     /* Path segments are percent-encoded; the slashes between them are kept. */
     expect(href).toContain("src/weird%20name/%40mod.ts");
     expect(href).toContain("#L10-L20");

graph-ui/src/lib/types.ts

@@ -32,8 +32,8 @@ export interface RepoInfo {
   root_path: string;
   branch: string;
   remote_url: string;
-  web_base: string; /* https://github.com/org/repo */
-  blob_base: string; /* https://github.com/org/repo/blob/<branch> */
+  web_base: string; /* e.g. github.com/<org>/<repo> */
+  blob_base: string; /* e.g. github.com/<org>/<repo>/blob/<branch> */
 }
 
 export interface GraphEdge {