Fix isDisallowed invalid URL handling

[AnandChowdhary]

Summary

• propagate undefined from isAllowed() through isDisallowed() for invalid/out-of-scope URLs instead of coercing it to true
• add regression coverage for invalid URL handling across both methods
• separate port-mismatch cases from explicitly disallowed URL cases in tests

Test plan

• git diff --cached --check
• added-line security scan: no findings
• independent Claude Code review: passed; no security concerns or logic errors
• npm test (44 passing, 100% coverage)
• npm audit --omit=dev (0 vulnerabilities)

Refs #41