Align demo-withdraw-api, goa-withdraw-ladder, refresh-demo-withdraw,
amount-ladder bench, and extreme tests with mon normalize rules so
libeufin host:443 never reaches wallets or QR payloads.
libeufin includes default HTTPS port; demo/auto-account APIs, refresh
scripts, and landing JS now normalize hosts without :443. ensure-taler-apps
also starts merchant ui-unlock after reboot.