Previously, entering an automatic membership email domain that included
an `@` (such as `@acme.io` or a pasted email or URL) warned the admin
and blocked the save until they hand-edited it down to a bare domain.
This change quietly normalizes those entries to the bare domain —
stripping any scheme, path, port, `@` prefix, casing, and surrounding
whitespace — so common paste mistakes just work, while the server still
rejects genuinely invalid domains on save.
Follow up to #41233