fix: validate app domains with HEAD requests

Use no-cors HEAD requests to check if app domains are actually
reachable. Only mark as invalid for DNS/connection failures
(ERR_NAME_NOT_RESOLVED, ERR_CONNECTION_REFUSED, timeout).
CORS blocks indicate the server exists, so don't mark invalid.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

src/view/atproto.js

···
     return avatars;
 }
 
-// Validate app URLs - only mark as invalid if URL is malformed
-// Namespaces come from ATProto lexicons, so reversed domains are valid by definition
+// Validate app URLs by checking if the domain is reachable
 export async function validateAppUrls(appDivs) {
     // Clear previous invalid apps
     state.invalidApps.clear();
 
-    appDivs.forEach(({ div, namespace }) => {
+    const validationPromises = appDivs.map(async ({ div, namespace }) => {
         const link = div.querySelector('.app-name');
         const url = link?.dataset.url;
-        if (!url) return;
+        if (!url || !link) return;
 
         try {
-            // Just check if it's a valid URL - don't try to fetch or validate the domain
-            new URL(url);
+            new URL(url); // Check syntax first
         } catch (e) {
-            // Malformed URL - mark as invalid
-            if (link) {
-                const displayName = link.textContent.replace(' ↗', '').replace(' \u2197', '');
-                link.classList.add('invalid-link');
-                link.setAttribute('title', 'malformed URL');
-                link.style.pointerEvents = 'none';
-                link.textContent = displayName;
-            }
-            if (namespace) {
-                state.invalidApps.add(namespace);
+            markInvalid(link, namespace, 'malformed URL');
+            return;
+        }
+
+        // Try HEAD request with short timeout to check if domain is reachable
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 3000);
+
+            await fetch(url, {
+                method: 'HEAD',
+                mode: 'no-cors',
+                signal: controller.signal,
+            });
+
+            clearTimeout(timeout);
+            // If we get here, domain is reachable (even if response is opaque due to CORS)
+        } catch (e) {
+            // Only mark as invalid for actual DNS/connection failures
+            // CORS blocks mean the server IS reachable, just not allowing our request
+            const errorMsg = e.message || '';
+            if (errorMsg.includes('ERR_NAME_NOT_RESOLVED') ||
+                errorMsg.includes('ERR_CONNECTION_REFUSED') ||
+                errorMsg.includes('ERR_CONNECTION_TIMED_OUT') ||
+                e.name === 'AbortError') {
+                markInvalid(link, namespace, 'domain not reachable');
             }
+            // For CORS blocks (ERR_FAILED) and other errors, server exists so don't mark invalid
         }
     });
+
+    await Promise.all(validationPromises);
+}
+
+function markInvalid(link, namespace, reason) {
+    const displayName = link.textContent.replace(' ↗', '').replace(' \u2197', '');
+    link.classList.add('invalid-link');
+    link.setAttribute('title', reason);
+    link.style.pointerEvents = 'none';
+    link.textContent = displayName;
+    if (namespace) {
+        state.invalidApps.add(namespace);
+    }
 }