iOS app accepts arbitrary HTTP server during onboarding and displays its web UI

**iOS device model, version and app version**

Model Name: iPhone 14 Pro
Software Version: 27.0
App version: 2026.9.0 (2026.2874)

**Home Assistant Core Version**

Installation type: Home Assistant Container
Core: 2026.8.1
Frontend: 20260729.6

**Describe the bug**

During the initial server setup, the Home Assistant Companion App accepts a reachable HTTP endpoint as the Home Assistant server without apparently verifying that the endpoint is actually serving Home Assistant.

I discovered this while configuring access to my Home Assistant instance over Tailscale.

My Raspberry Pi hosts both Home Assistant on port `8123` and another web application (OpenClaw Gateway) on port `80`. Tailscale MagicDNS resolves the hostname to this Raspberry Pi.

When I enter the Tailscale hostname without specifying port `8123`, the app connects to port `80` and displays the OpenClaw Gateway web interface inside the Home Assistant app instead of reporting that the endpoint is not a Home Assistant server.

**To Reproduce**

1. Have Home Assistant available at `http://hostname:8123`.
2. Run another HTTP web server/application on the same host on port `80`.
3. Start the Home Assistant Companion App and begin the initial server setup.
4. Select **Enter address manually**.
5. Enter the hostname without specifying port `8123`, for example:
`http://hostname`
6. The app connects to port `80`.
7. The HTTP server on port `80` returns a valid HTML page.
8. The Companion App displays the unrelated web application inside the app.

In my case, the web application running on port 80 is OpenClaw Gateway.

**Expected behavior**

The app should detect that the endpoint does not appear to be a Home Assistant instance and report an appropriate error instead of displaying the contents of an unrelated HTTP server.

For example, it could report that the specified address does not appear to be a Home Assistant server, or validate the endpoint using a Home Assistant-specific API/resource before accepting it.

**Screenshots**

Not attached. The behavior is straightforward to reproduce.

**Additional context**

The issue also creates a configuration dead end because the unrelated web interface is displayed as the result of the connection attempt, leaving no obvious way to return to the server configuration screen.

As a workaround, I temporarily disabled Tailscale on the iPhone. This made the hostname unreachable and caused the Companion App to return to the server configuration screen. I then entered the correct URL including port `8123`:

`http://hostname:8123`

After re-enabling Tailscale, Home Assistant connected normally.

This does not appear to be specific to OpenClaw. OpenClaw simply makes the behavior particularly obvious because it provides a complete web UI on port 80. The same behavior could potentially occur with any HTTP service returning a valid web page.

The behavior is reproducible and deterministic when the hostname resolves to a host running another HTTP service on port 80.

Start by reproducing the initial server setup through Enter address manually with a reachable non-Home-Assistant HTTP service on port 80. Trace the onboarding connection and endpoint-validation flow; done means an unrelated HTML service is rejected with an error and the user can return to server configuration, while a Home Assistant URL including port 8123 still connects.

Written by the indexing model from the issue text.