feat(core): import_lastpass — URL/header robustness

Bad URLs in login rows downgrade to url: None with a warning
rather than skipping the row. Header mismatches (extra columns,
wrong order) surface ImportCsvHeader. Quoted commas, multi-line
extra, unicode all parse cleanly via the csv crate's defaults.

crates/relicario-core/src/import_lastpass.rs

@@ -132,9 +132,27 @@ fn map_row(
         }));
     }
 
-    let parsed_url = if url.is_empty() { None } else { Url::parse(url).ok() };
-
     let mut warning: Option<ImportWarning> = None;
+
+    let parsed_url = if url.is_empty() {
+        None
+    } else {
+        match Url::parse(url) {
+            Ok(u) => Some(u),
+            Err(_) => {
+                // Login still imports — URL becomes None, with a warning.
+                if warning.is_none() {
+                    warning = Some(ImportWarning {
+                        row,
+                        title: Some(name.to_string()),
+                        message: format!("invalid URL `{url}` — login imported without URL"),
+                    });
+                }
+                None
+            }
+        }
+    };
+
     let totp = if totp_raw.is_empty() {
         None
     } else {
@@ -147,11 +165,14 @@ fn map_row(
                 kind: crate::item_types::TotpKind::Totp,
             }),
             _ => {
-                warning = Some(ImportWarning {
-                    row,
-                    title: Some(name.to_string()),
-                    message: "invalid base32 TOTP secret — login imported without TOTP".into(),
-                });
+                if warning.is_none() {
+                    warning = Some(ImportWarning {
+                        row,
+                        title: Some(name.to_string()),
+                        message: "invalid base32 TOTP secret — login imported without TOTP"
+                            .into(),
+                    });
+                }
                 None
             }
         }