fix(import): silently drop invalid URLs instead of rejecting entire import (#162)

LinkedIn exports sometimes contain invalid credential URLs (e.g. partial
URLs or non-URL text). Previously, one bad URL in any certification,
project, or publication would cause the entire import to fail with a 400
"Validation failed" error.

The optionalUrl() Zod helper now validates URLs at parse time and
silently drops invalid ones to undefined, allowing the rest of the
import to proceed.

Closes #170

src/routes/schemas.ts

···
 import { z } from 'zod';
 
+/** Accept a URL string or silently drop it if invalid (returns undefined). */
+const optionalUrl = () =>
+  z
+    .string()
+    .optional()
+    .transform((val) => {
+      if (!val) return undefined;
+      try {
+        new URL(val);
+        return val;
+      } catch {
+        return undefined;
+      }
+    });
+
 const locationSchema = z
   .union([
     z.object({
···
   name: z.string().min(1).max(100),
   authority: z.string().max(100).optional(),
   credentialId: z.string().max(100).optional(),
-  credentialUrl: z.string().url().optional(),
+  credentialUrl: optionalUrl(),
   issuedAt: z.string().optional(),
   expiresAt: z.string().optional(),
 });
···
 export const projectSchema = z.object({
   name: z.string().min(1).max(100),
   description: z.string().max(50000).optional(),
-  url: z.string().url().optional(),
+  url: optionalUrl(),
   startDate: z.string().optional(),
   endDate: z.string().optional(),
 });
···
 export const publicationSchema = z.object({
   title: z.string().min(1).max(200),
   publisher: z.string().max(100).optional(),
-  url: z.string().url().optional(),
+  url: optionalUrl(),
   description: z.string().max(50000).optional(),
   publishedAt: z.string().optional(),
 });

tests/routes/import.test.ts

···
     expect(res.statusCode).toBe(503);
   });
 
+  it('POST /api/import/linkedin/confirm strips invalid credential URLs instead of rejecting', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/import/linkedin/confirm',
+      payload: {
+        certifications: [
+          { name: 'Valid Cert', credentialUrl: 'https://example.com/cert' },
+          { name: 'Bad URL Cert', credentialUrl: 'not-a-url' },
+          { name: 'Empty URL Cert', credentialUrl: '' },
+          { name: 'No URL Cert' },
+        ],
+        projects: [{ name: 'Proj', url: 'garbage' }],
+        publications: [{ title: 'Pub', url: '????' }],
+      },
+      cookies: { session: 'test-session-id' },
+    });
+    // 503 because no OAuth client -- but it passed validation (not 400)
+    expect(res.statusCode).toBe(503);
+  });
+
   it('POST /api/import/linkedin/confirm accepts valid payload with all sections', async () => {
     const res = await app.inject({
       method: 'POST',