fix(map): validate suggest-place links and preserve input

[AyobamiH]

Fixes #150.

What this changes

Hardens the map's "Suggest a place" flow in two places:

• validates the Google Maps field as an HTTPS URL on supported Google Maps hosts and rejects malformed, insecure, lookalike, or unrelated URLs inline
• preserves all entered form data when the browser blocks the GitHub popup, shows an error toast, and exposes a safe fallback link instead of closing the dialog

There is an important popup-security nuance here. Passing noopener in window.open(..., windowFeatures) can itself make the returned window handle null, which makes a successful open indistinguishable from a blocked popup.

The implementation instead opens a blank tab synchronously from the user click, checks the returned handle, immediately sets opened.opener = null, and only then navigates it to the pre-filled GitHub issue. The fallback link still uses rel="noopener noreferrer".

Regression evidence

RED

Test-only commit:

127cf5b4f33c52db321f458d9000b5d63902c0e2

The new suggest-place-dialog regression suite failed against the original implementation as expected.

Results:

• 11 new tests failed
• existing build passed
• existing data validation passed
• failures reproduced the missing URL validator
• invalid-link inline feedback was absent
• blocked-popup behavior followed the old three-argument window.open path
• opener isolation was not performed

Fork CI run: 32713989798

GREEN

Final commit:

c68da740071afaf8f873b01ef9b6a560f1fe3c1a

The final branch is one commit ahead of current upstream main and changes only:

• src/components/map/suggest-place-dialog.tsx
• src/components/map/suggest-place-dialog.test.tsx

Final verification passed:

• npm run test:unit
• npm run build
• npm run validate
• npm run lint
• npx tsc --noEmit

Fork CI run: 32714425499
Lint/typecheck run: 32714425310

Type of change

• New public place(s)
• New or updated benefit guide
• New or updated resource link
• Code or fix
• Docs

Proof (required for new public places)

Not applicable. This PR does not change place data.

Checklist

• The site hosts no copyrighted files; resource and paper changes are links only.
• No em dashes in any copy.

[vercel]

@AyobamiH is attempting to deploy a commit to the studentsuite Team on Vercel.

A member of the Team first needs to authorize it.