fix(ci): use allowlist regex for backend_url validation

The previous blocklist regex `[^[:space:]/?#:]+` did not reject `$`, so a
backend_url like `https://evil.com/$GITHUB_TOKEN/` passed validation and was
written to .env.alpha as `VITE_ORIGIN=...`. Vite processes env files with
dotenv-expand, which would expand `$GITHUB_TOKEN` to the runner's secret and
bake it into the public gh-pages JS bundle.

Switch to positive character classes that only allow URL-safe chars for the
host (`a-zA-Z0-9._-`) and path (`a-zA-Z0-9._/~:%-`), blocking `$`, backticks,
parentheses, and other dotenv/shell metacharacters while still permitting
percent-encoded path segments like `%20`.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: hexqi

.github/workflows/deploy-gh-pages.yml

@@ -45,8 +45,8 @@ jobs:
             exit 1
           fi
 
-          if [[ ! "$ENV_BACKEND_URL" =~ ^https?://[^[:space:]/?#:]+(:[0-9]+)?(/[^[:space:]?#]*)?$ ]]; then
-            echo "::error::backend_url must be an http(s) base URL without query or hash"
+          if [[ ! "$ENV_BACKEND_URL" =~ ^https?://[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/~:%-]*)?$ ]]; then
+            echo "::error::backend_url must be an http(s) base URL using only URL-safe characters (letters, digits, . _ - / ~ : %)"
             exit 1
           fi