fix(rest): reject malformed authorization URLs

[fallintoplace]

Summary

• reject malformed rest.authorization-url values instead of silently ignoring them
• propagate auth URL parse failures from both initial catalog props and fetched REST config
• add regression coverage for invalid local props and invalid server config

Why

fromProps previously swallowed url.Parse errors and left authUri unset. When OAuth credentials were later used, the client fell back to baseURI.JoinPath("oauth/tokens"), so a typo in rest.authorization-url could quietly send credentials to a different endpoint than intended.

Testing

• go test ./catalog/rest -run 'Test(LoadRegisteredCatalogRejectsInvalidAuthURL|NewCatalogRejectsInvalidAuthURLFromConfig)$' -count=1
• go test ./catalog/rest -count=1

[tanmayrauth]

Clean fix, the silent fallback to the default OAuth endpoint on a typo'd auth URL was a real credential-misrouting hazard