fix 1.23.4: normalize taler:// :443/:80 + mon scan all landings

Shared lib.sh normalize_taler_uri for ladder/e2e/pay. urls phase checks
public bank/exchange/merchant intros and bank mint JSON for residual
default ports (ERROR on GOA/local). Unit test included.

lib.sh

@@ -1504,6 +1504,53 @@ load_monitoring_secrets_env() {
   export E2E_BANK_ADMIN_PASS E2E_MERCHANT_TOKEN SECRETS_ROOT KOOPA_ADMIN_SECRETS
 }
 
+# Strip default HTTPS/HTTP ports from taler:// URIs (libeufin often emits host:443).
+# Wallets and mon QR rules reject default :443/:80 in the authority.
+# Usage: normalize_taler_uri "taler://withdraw/host:443/…"  → prints cleaned URI
+normalize_taler_uri() {
+  local u="${1-}"
+  if [ -z "$u" ]; then
+    return 0
+  fi
+  printf '%s' "$u" | python3 -c '
+import re, sys
+u = sys.stdin.read().strip()
+# any taler://SCHEME/HOST:443|80/...
+u = re.sub(
+    r"(taler://[A-Za-z0-9._-]+/)([^/?#:]+):443(?=/|$|\?|#)",
+    r"\1\2",
+    u,
+    flags=re.I,
+)
+u = re.sub(
+    r"(taler://[A-Za-z0-9._-]+/)([^/?#:]+):80(?=/|$|\?|#)",
+    r"\1\2",
+    u,
+    flags=re.I,
+)
+# leftover path/query forms
+for a, b in (
+    (":443/", "/"),
+    (":443?", "?"),
+    (":443#", "#"),
+    (":80/", "/"),
+    (":80?", "?"),
+    (":80#", "#"),
+):
+    u = u.replace(a, b)
+# bare trailing :443 / :80 on host (no slash)
+u = re.sub(r"(taler://[A-Za-z0-9._-]+/[^/?#:]+):443$", r"\1", u, flags=re.I)
+u = re.sub(r"(taler://[A-Za-z0-9._-]+/[^/?#:]+):80$", r"\1", u, flags=re.I)
+sys.stdout.write(u)
+' 2>/dev/null || printf '%s' "$u"
+}
+
+# True (exit 0) if URI still has default port in taler:// authority.
+taler_uri_has_default_port() {
+  # host:443 or host:80 before next path/query/end
+  python3 -c "import re,sys; u=sys.argv[1] if len(sys.argv)>1 else ''; sys.exit(0 if re.search(r'taler://\\S+:(443|80)(/|$|\\?|#)', u, re.I) else 1)" "${1-}" 2>/dev/null
+}
+
 find_wallet_cli() {
   # Must return a path suitable for: node "$WALLET_CLI" …
   # Prefer *.mjs / bundled entry; plain /usr/bin/taler-wallet-cli is often a