feat(tips): put the tipcard link at the root when there's no handle

[bmc08gt]

An unclaimed card shared app.flipcash.com/tip/{uuid} while a claimed one shared flipcash.com/{handle}, so claiming a handle changed both the host and the path shape of a link its owner may already have printed or posted. Both forms now sit at the root of the apex host: flipcash.com/{uuid} until there's a handle, flipcash.com/{handle} after.

Linkify.tipcard is the only place either URL is built, so that's a one-line change. The rest is making the link resolve back into the app.

Routing

AppRouter's bare-host branch (isVanityProfile, now isProfileLink) takes either shape. A uuid can't be mistaken for a handle — dashes aren't in the server's [a-z0-9_]{2,15} charset and 36 characters overruns it — so the two share the root without ambiguity, and only the handle form needs the reserved-path list that keeps /download and /privacy with the website.

The uuid test is a regex rather than UUID.fromString, which also accepts 1-1-1-1-1. An unrecognised path on this host is handed back to the browser, so claiming a looser shape would take taps away from pages the website serves.

VANITY_HOST and reservedVanityPaths are renamed to PROFILE_HOST and reservedProfilePaths: the host now carries both forms, and only one of them is a vanity link.

Manifest

A matching uuid pathAdvancedPattern for flipcash.com and www.flipcash.com, with A-F in the set for the same reason the handle pattern has A-Z — the matcher is case-sensitive and a link gets typed or auto-capitalised. As with the handle pattern, the platform ignores it below API 31 and the whole host arrives, which is why isProfileLink makes the same distinction in code.

Compatibility

app.flipcash.com/tip/{uuid} still routes, and its App Link filter is untouched. Links already shared carry that form; nothing writes it any more.

iOS

code-payments/code-ios-app#670 moves the same link to the root. The two agree on the produced shape, on rejecting a partial uuid, and on the abbreviated display (flipcash.com/b0ced…).

One tolerance difference: iOS also parses a root uuid on app.flipcash.com and under its custom scheme, where Android accepts it on the bare and www hosts only. Nothing builds those forms, and Android's manifest doesn't claim them, so widening the router alone wouldn't make such a link arrive. Left as is.

Depends on

flipcash.com/{uuid} has to resolve on the website for a tap without the app installed. Verification for the apex already relies on assetlinks.json at https://flipcash.com/.well-known/, which the handle links needed too.