fix: prevent SecurityError in pushState when playing video on local origin

When running the application locally (e.g., `127.0.0.1:5500`) but using a production configuration (`BITVID_WEBSITE_URL` pointing to `bitvid.network`), `playVideoByEventId` would attempt to `pushState` with the production URL. This triggers a browser `SecurityError` due to the origin mismatch, preventing the video modal from opening.

This change adds a check to normalize the `pushUrl`. If the target URL's origin differs from the current window's origin, it falls back to a relative path using `window.location.pathname` combined with the target's search parameters and hash. This ensures `pushState` always receives a safe, same-origin URL regardless of the environment configuration.

js/app.js

@@ -8713,11 +8713,21 @@ class Application {
     // this.setShareButtonState(true); // Moved to after showModalWithPoster
 
     const nevent = window.NostrTools.nip19.neventEncode({ id: eventId });
-    const pushUrl =
+    let pushUrl =
       this.buildShareUrlFromNevent(nevent) ||
       `${this.getShareUrlBase() || window.location.pathname}?v=${encodeURIComponent(
         nevent
       )}`;
+
+    try {
+      const targetUrl = new URL(pushUrl, window.location.origin);
+      if (targetUrl.origin !== window.location.origin) {
+        pushUrl = `${window.location.pathname}${targetUrl.search}${targetUrl.hash}`;
+      }
+    } catch (err) {
+      devLogger.warn("[Application] Failed to normalize pushState URL:", err);
+    }
+
     window.history.pushState({}, "", pushUrl);
 
     this.zapController?.resetState();