Harden input parsing, portability, IPv6 support and CI - #2

Summary

Hardening pass for the next 0.4.x release. The branch is intentionally focused on correctness, portability and release quality rather than new scanning features.

Runtime correctness

• share domain/URL normalization across -d, -l and the local web UI
• add the documented --page-size alias for --limit
• reject invalid negative/zero numeric CLI settings before a run starts
• fix IPv6 URL canonicalization, IPv6 GUI binding and bracketed HTTP authorities
• make output filenames portable when targets contain ports/IPv6 characters
• correct the pagination warning so it identifies auto as the default

Tests and CI

• regression coverage for target parsing, IPv6, invalid ports, numeric validation and portable filenames
• Python 3.9–3.14 Linux test matrix plus Python 3.13 smoke tests on Ubuntu, Windows and macOS
• cancel stale CI runs when the same PR branch is superseded
• update actions/checkout and actions/setup-python to their current Node 24-based major versions
• add weekly Dependabot updates for Python and GitHub Actions

Release and documentation

• run twine check and smoke-test the built wheel before PyPI publishing
• align README, manpage, CLI reference, architecture, internals and testing docs
• improve private security-reporting and contribution guidance
• record the work under Unreleased in the changelog

No active target crawling or scanning behavior is introduced; wayparam remains a passive Wayback CDX client.