Mixed-case public file URLs are not resolved or tracked

Problem/Motivation

UrlToEntity::findEntityIdByUrl() lowercases the entire URL. Hostnames are case-insensitive, but managed-file paths are not. With Drupal 11.4.4 and Entity Usage 5.0.1, a file whose URI is public://example/MixedCase.pdf is not found by the resulting lookup for public://example/mixedcase.pdf. Current 5.x source has the same normalization.

An ordinary HTML hyperlink in a saved draft therefore produces no html_link reference, although the exact file URL returns 200. Consumers of usage data may consequently delete a still-linked file: Media File Delete's Entity Usage integration can remove the file during bulk media deletion after removing the media's own references.

This differs from Media File Delete's duplicate media-usage issue #3538455. Related Entity Usage issues #3521603 and #3537701 address public-file patterns, not whole-URL lowercasing; their fixes do not resolve this reproduction.

Steps to reproduce

1. On a disposable local site, enable Entity Usage with nodes as sources, files as targets, and HTML links enabled.
2. Create a managed PDF with URI public://example/MixedCase.pdf. Verify the stored filename retains capitalization.
3. Save an unpublished node with a formatted body containing a plain anchor, without media embedding or LinkIt metadata: <a href="http://localhost/sites/default/files/example/MixedCase.pdf">PDF</a>.
4. Verify the exact URL returns 200.
5. Call findEntityIdByUrl() on the Drupal\entity_usage\UrlToEntityInterface service and inspect the file's Entity Usage sources.
6. Observe NULL resolution and no node/body hyperlink source. A wholly lowercase directory/filename control resolves and tracks correctly.

Optional integration reproduction: create Document media referencing that disposable file, then use the actual Media listing to bulk-delete only that media with associated-file deletion selected. The file can be removed although the saved draft still links to it. A single-delete retention message is not sufficient proof, because duplicate media usage can mask the missing hyperlink.

Proposed resolution

• Preserve path and filename capitalization in the shared URL resolver.
• Compare parsed hostnames case-insensitively in SiteDomains; preserve configured and discovered base paths, including public stream-wrapper paths and the legacy domain conversion.
• In the public-file integration, compare scheme and hostname case-insensitively while matching paths case-sensitively. Derive the managed URI from the URL path alone, excluding query/fragment suffixes. Decode path escapes with rawurldecode() so literal plus signs remain plus signs.
• Keep exact URI queries. Files named MixedCase.pdf and mixedcase.pdf must resolve to distinct IDs. Do not rename files or rewrite stored content.

The prepared fix extends the existing kernel file-tracking test with real managed files and saved plain HTML fields. Coverage includes absolute/root-relative/relative links, uppercase hostnames and schemes, encoded spaces/plus signs, query/fragment suffixes, filenames differing only by case, wrong-case directories, external-host rejection, and a non-local wrapper exposing a mixed-case CDN base path. Only the external wrapper URL is stubbed; entity storage, queries and URL resolution are real. Additional focused checks cover SiteDomains and legacy config conversion.

The managed-file regression fails without the fix at MixedDirectory/MixedCase.pdf (NULL resolution) and passes with it. Focused checks: 55 tests, 253 assertions passing. A real local bulk-delete smoke test retained the saved draft's mixed-case file (entity and disk present, HTTP 200), while deleting an unreferenced lowercase control (entity and disk absent, HTTP 404). Retention was backed by actual node/body html_link sources, with no remaining media or core file-usage entries.

Remaining tasks

Review, CI, merge and release. After deployment, rebuild existing usage statistics on each site with drush entity-usage:recreate or /admin/config/entity-usage/batch-update. Avoid file deletion during rebuilds. Installing the fix alone does not repair previously missed references.

User interface changes

None.

API changes

SiteDomains::getInternalUrl() no longer requires lowercased input. It preserves path capitalization and compares hosts case-insensitively. Wrong-case base paths no longer match.

Data model changes

No schema changes.

Disclosure: AI-assisted investigation and coding, verified with executable regression and local integration checks. Examples are synthetic localhost fixtures. This is incorrect reference recognition during authorized deletion, not an identified access-control bypass.