[chaksaray]

Closes #54

What and why

The extension's AVE base URL was a hardcoded constant (AVE_RECORDS_BASE) used at six call sites, each building its own records URL, plus a literal in the report footer. Following the "one place, configurable, validated" rule:

• Setting bawbel.aveApiUrl, default https://api.aveproject.org, with pattern: ^https?:// so the Settings UI flags a bad value
• core/urls.ts (no vscode import, so it runs in plain Node): resolveAveApiUrl() parses the value with new URL(), requires http:/https: and a host, and rebuilds the base from origin and path (percent-encoded, no query or fragment, no trailing slash). Anything else gives the default
• core/links.ts: aveRecordLink(id) and aveRecordsIndexLink() are the only code that builds AVE links. Hover, diagnostic codes, the quick action, the open command, and the report footer all use them
• Defense in depth: the report footer passes the link through escapeHtml
• DEFAULT_AVE_API_URL in core/types.ts is the one remaining literal

Action inputs and outputs

Not changed (extension only).

Checks

$ git grep -n 'api.aveproject.org' -- vscode/src
vscode/src/core/types.ts:85:export const DEFAULT_AVE_API_URL = "https://api.aveproject.org";  // setting: bawbel.aveApiUrl

$ git grep -n -E '/records/\$\{|/records`' -- vscode/src     (outside core/urls.ts, core/links.ts)
(no output)

$ npm run compile          (Node v20.20.2)  -> exit 0

resolveAveApiUrl, compiled out/core/urls.js, plain Node:
ok  "https://mirror.example.org/"           -> https://mirror.example.org
ok  "  http://ave.internal:8080  "          -> http://ave.internal:8080
ok  "https://ave.example.org/api/v1/"       -> https://ave.example.org/api/v1
ok  "https://ave.example.org/?q=1#x"        -> https://ave.example.org
ok  "file:///etc/passwd"                    -> https://api.aveproject.org
ok  "javascript:alert(1)"                   -> https://api.aveproject.org
ok  "https://"                              -> https://api.aveproject.org
ok  ""  / undefined / 42                    -> https://api.aveproject.org
ok  "https://x\" onmouseover=\"alert(1)"   -> https://api.aveproject.org
ok  "https://ok.example/a\"b"              -> https://ok.example/a%22b

develop has no extension test runner; your #15 adds vitest. When it lands, these resolver cases belong in a unit test.

• Docs and examples/ use bawbel/integrations@v1
• No em dashes