fix: address code review findings for bookmark feature (H1–L5)

Fix broken tests (H1), align interface signatures with implementations (H3),
remove dead code (H4), add missing input guard (M1), replace raw $_SESSION
access with SessionStoreInterface (M2), sync update script schema (M4),
use shared getAppBase utility (L2), document fragment stripping (L3),
and apply app- CSS class prefix convention (L5).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/Support/BookmarkUrlNormalizer.php

@@ -7,10 +7,12 @@ final class BookmarkUrlNormalizer
     public static function canonicalizeRelative(string $url): string
     {
         $url = trim($url);
-        if ($url === '') {
+        if ($url === '' || str_contains($url, "\x00")) {
             return '';
         }
 
+        // Strip fragments: they are client-side only and should not
+        // differentiate bookmarks during deduplication.
         $hashPos = strpos($url, '#');
         if ($hashPos !== false) {
             $url = substr($url, 0, $hashPos);
@@ -20,7 +22,7 @@ final class BookmarkUrlNormalizer
             return '';
         }
 
-        if (preg_match('#^[a-z][a-z0-9+.-]*://#i', $url) || str_starts_with($url, '//')) {
+        if (preg_match('#^[a-z][a-z0-9+.-]*:#i', $url) || str_starts_with($url, '//')) {
             return '';
         }
 
@@ -77,6 +79,7 @@ final class BookmarkUrlNormalizer
 
         $segments = explode('/', $collapsed);
         $normalized = [];
+        $depth = 0;
 
         foreach ($segments as $segment) {
             $segment = trim($segment);
@@ -85,11 +88,16 @@ final class BookmarkUrlNormalizer
             }
 
             if ($segment === '..') {
+                if ($depth <= 0) {
+                    return '';
+                }
                 array_pop($normalized);
+                $depth--;
                 continue;
             }
 
             $normalized[] = $segment;
+            $depth++;
         }
 
         return implode('/', $normalized);