Keep the empty host for a state_dir starting with //

With OmitHost set, a state_dir starting with // gave a db_url starting
file://, and SQLite read the first directory name as a host, so pixa
failed to start. OmitHost is now left off for such a directory: the URL
starts file://// and SQLite reads an empty host followed by the path.
Every other state_dir gives the same URL as before.

Model: opus-5-5

TODO.md

@@ -67,7 +67,9 @@ P2: security: per-origin rate limiting
   it put the name into a `file:` URL as it was, so SQLite read `%41` as `A`, a
   `?` or `#` ended the path early, and the journal mode parameter was lost. The
   derived `db_url` is now built with Go's `net/url`, which writes those
-  characters as `%25`, `%3F` and `%23`.
+  characters as `%25`, `%3F` and `%23`. For a `state_dir` starting with `//` it
+  starts `file:////`, so SQLite no longer reads the first directory name as a
+  host.
 - 2026-10-15 a thin source requested with `fit=cover` no longer makes libvips
   build a huge image (closes #282): libvips' thumbnail scaled the whole source
   to cover the requested size and copied that into memory before it cut out the