Convex: tokens, URLs and uploads

The Convex helpers send a user's JWT from your server, so they are strict about where it goes. See the Convex guide for the options.

• The deployment URL names one origin. fetchQuery, fetchMutation, fetchAction and createConvexClient refuse credentials in the URL (https://user:pass@host), a query, a fragment, a backslash, and http:// for anything but localhost, 127.0.0.1 and [::1]. What passes is rewritten to its canonical form, so every reader of the string sees the same host. A trailing newline from an environment variable is trimmed.
• The token is the JWT alone. A token with a space, a newline or a non-ASCII character is refused with an error that does not contain it. A call without a token clears a shared caller first.
• The server helpers never follow a redirect, only talk to the deployment's origin, stop after timeoutMs (30 seconds for a query or mutation, 10 minutes for an action) and reject a response over maxResponseBytes (32 MiB). A client from your own createClient needs the same limits.
• Uploads go to the deployment's origin. useUploadFile refuses an upload URL that is not https (or loopback http), carries credentials, or is on another origin than the client's deployment; list a proxy with allowedOrigins. The file is sent without cookies and without following redirects.
• fromConvexValidator errors never echo the value; they hold a short message and a path. Keep the logs of rejected input to those two fields as well.