pub fn registry_host(base: &str) -> String
Extract the hostname for credentials keying. Falls back to the full URL on parse failure so nothing silently collides.