feat(onboarding): accept modbus:// and opc.tcp:// live-URL refs

The ICS probe targets a device's OT ports (Modbus 502, OPC UA 4840,
EtherNet/IP 44818) via the target's LiveUrl artifact. The wizard's
client-side validation only accepted http(s):// refs, so a PLC endpoint
like modbus://plc:502 was rejected and the probe could never be
onboarded. parse_endpoint already understands the modbus:// scheme;
this just lets the ref through the wizard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compliance-dashboard/src/infrastructure/onboarding.rs

@@ -78,8 +78,16 @@ pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
                 .then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
         }
         "live_url" => {
-            let ok = (s.starts_with("https://") || s.starts_with("http://")) && no_space;
-            (!ok).then(|| "Enter an http(s) URL, e.g. https://app.example.com".to_string())
+            // http(s) for web/DAST targets; modbus:// and opc.tcp:// for ICS
+            // devices probed by the ICS probe (e.g. modbus://plc:502).
+            let ok = (s.starts_with("https://")
+                || s.starts_with("http://")
+                || s.starts_with("modbus://")
+                || s.starts_with("opc.tcp://"))
+                && no_space;
+            (!ok).then(|| {
+                "Enter a URL — https://app.example.com, or modbus://host:502 for a PLC".to_string()
+            })
         }
         "container_image" => {
             (!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())