#101 serve same-origin gate ignores port and scheme

What

The local serve same-origin gate compares only hostnames; it discards scheme and port.

src/serve.rs:599-658: host_of_url() strips :port; origin_allowed() compares want == got.

Reproduced

Run hu13 serve on 127.0.0.1:39333, then:

curl -X POST \
  -H 'Origin: http://127.0.0.1:9999' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'title=Hello&body=World&license=agree' \
  http://127.0.0.1:39333/inbox/issue

Response is 200 and a submission is stored. A browser page on a different local port (or different scheme) can therefore POST to the inbox, even though the Pages Function compares .host including the port.

Impact

Cross-origin POST/CSRF bypasses the browser same-origin gate; local/Pages behavior differs.

Fix

Compare normalized scheme + host + port (handle default ports), not just the hostname. Add tests for same host/different port and different scheme; keep the curl no-Origin path.