Fix WordPress URLs in the Figma sandbox

[DavidBabinec]

What changed

• remove browser URL constructor usage from the Figma main-thread bundle
• parse and validate HTTP(S) origins with sandbox-compatible JavaScript
• pass URL strings directly to Figma's Fetch API
• cover the exact 79-character WordPress connection-key format reported in production
• verify the complete main bundle contains no URL constructor calls

Root cause

Figma runs main plugin code in a minimal JavaScript sandbox without normal browser APIs. The WordPress key was valid, but new URL(...) threw inside that sandbox. The parser caught the runtime error and mislabeled it as an invalid connection key. The same browser-only constructor was also present in the subsequent synchronization request path.

Validation

• 7 Figma tests pass, including the exact 79-character key and a test with globalThis.URL removed
• bun run build:figma
• bun run release:figma -- 2.0.0
• source and packaged Figma open-source boundary checks
• compiled dist/code.js contains no URL constructor usage