Fix duplicate Needs Review rows for equivalent URL spellings

[Boreas37]

Problem\nNeeds Review could project multiple rows when the same candidate was observed through transport-equivalent URL spellings, such as host case differences, an explicit default port, fragment changes, or different values for the same query keys.\n\n## Fix\n- Normalize scheme and hostname case.\n- Strip only the scheme's default port and drop fragments.\n- Keep the first observed raw URL as the actionable evidence URL.\n- Reload the authoritative candidate after fingerprint upsert so repeated spellings project through the same candidate identity.\n- Preserve security-relevant boundaries: www vs apex, trailing slash, query-key case, scheme, subdomain, and non-default port remain distinct unless future response evidence proves equivalence.\n\n## Verification\n- Regression coverage for equivalent host/default-port/fragment spellings.\n- Regression coverage preventing false merges across www/apex, trailing slashes, query-key case, schemes, subdomains, and non-default ports.\n- go test ./internal/scanner ./internal/api ./internal/database\n- go vet ./internal/scanner ./internal/api ./internal/database\n- targeted race tests pass.\n\nExisting legacy duplicate rows are not destructively backfilled; rescans use the corrected identity path.

[rootdr-backup]

Thanks for tracing the duplicate projection path. I rebased this on current main and tightened the normalization before merge: default ports, host/scheme case and fragments are canonicalized, while www/apex, trailing slash and query-key case remain separate because they can represent different origins or handlers. Projection now reuses the authoritative candidate URL, so dedup no longer turns evidence URLs into non-actionable endpoint templates. Full scanner/API/database tests, vet and targeted race tests pass.