fix(seo): rebase only the exact default authority, insert SITE_URL literally

Review follow-up: the origin regex also matched a port
(https://www.bentopdf.com:8443) and userinfo
(https://www.bentopdf.com@other.example), which are different origins;
the lookahead now excludes ':' and '@'. The replacement is a callback,
so `$&`/`$1` in SITE_URL stay literal. Tests cover both.

scripts/site-origin.mjs

@@ -4,16 +4,20 @@
  */
 export const DEFAULT_SITE_URL = 'https://www.bentopdf.com';
 
-const DEFAULT_ORIGIN_RE = /https:\/\/www\.bentopdf\.com(?![\w.-])/g;
+// The exact authority only: not a longer host (`.com.example`), a port
+// (`:8443`, a different origin) or userinfo (`@other.example`, another host).
+const DEFAULT_ORIGIN_RE = /https:\/\/www\.bentopdf\.com(?![\w.:@-])/g;
 
 /**
  * Rewrites absolute URLs on the default origin to `siteUrl` (no trailing
  * slash). Used for hand-written pages that carry the official origin
  * literally, so a build with a custom SITE_URL emits canonicals on its own
- * host. Other hosts, including look-alikes such as
- * `https://www.bentopdf.com.example`, are left untouched.
+ * host. Other origins are left untouched: look-alike hosts such as
+ * `https://www.bentopdf.com.example`, other ports and userinfo URLs.
  */
 export function rebaseDefaultOrigin(html, siteUrl) {
   if (siteUrl === DEFAULT_SITE_URL) return html;
-  return html.replace(DEFAULT_ORIGIN_RE, siteUrl);
+  // A callback keeps `siteUrl` literal: a string replacement would expand
+  // `$&`, `$1`, … inside it.
+  return html.replace(DEFAULT_ORIGIN_RE, () => siteUrl);
 }