pub fn normalize_host(host: &str) -> String
Normalize host fragments for policy matching (trim whitespace, strip ports/brackets, lowercase).