Coupons: a request path that would leave the origin is a 404, not a 500 (the not-found page's canonical threw) (#68)

ddiff --git a/server/http/public.js b/server/http/public.js
iindex 030299a..34cbea0 100644
---- a/server/http/public.js
++++ b/server/http/public.js
@@@ -58,9 +58,13 @@ function createPublicRoutes(ctx) {
  
      /** A decision for pages that are not a shop or a code. */
      function pageDecision(path, { indexable = true, query = [] } = {}) {
++        // A request path that would leave the origin ("//host/x", sent by scanners) has no canonical of its own:
++        // canonicalUrl() refuses it, which turned a 404 into a 500. It gets the site's root, never indexed.
++        let canonicalUrl;
++        try { canonicalUrl = seo.canonicalUrl(config.baseUrl, path, { query }); } catch { canonicalUrl = seo.canonicalUrl(config.baseUrl, '/'); indexable = false; }
          return seo.evaluate({
              state: indexable ? 'published' : 'draft', visibility: indexable ? 'public' : 'private',
--            canonicalUrl: seo.canonicalUrl(config.baseUrl, path, { query }), wordCount: 0,
++            canonicalUrl, wordCount: 0,
          }, { policy: { minWords: 0 }, now: store.now() });
      }
  
ddiff --git a/test/pages-discovery.test.js b/test/pages-discovery.test.js
iindex 5b067df..36cf49b 100644
---- a/test/pages-discovery.test.js
++++ b/test/pages-discovery.test.js
@@@ -193,6 +193,7 @@ const { boot, check, done } = require('./helpers/boot');
          assert.strictEqual(rel.json().metrics_url, '/release-metrics');
          assert.strictEqual((await t.get('/nope')).status, 404);
          assert.strictEqual((await t.get('/m/nope')).status, 404);
++        assert.strictEqual((await t.get('//evil.example/x')).status, 404, 'a path that would leave the origin is a 404, not a 500 (scanners, 10-16)');
          assert.strictEqual((await t.get('/c/cpn_00000000000000000000000000')).status, 404);
          const api404 = await t.get('/api/v1/nope');
          assert.strictEqual(api404.status, 404);