fix: URL coercion regression for plain str inputs

[erayack]

Summary

• replace file-field detection with explicit per-field coercion targets (File/Path)
• only coerce URL-like strings for explicitly typed File/Path fields (including Optional[...] and list[...] forms)
• keep explicit str fields untouched
• restore legacy fallback when typing.get_type_hints() fails by coercing URL-like strings via Path.validate()

Why

Issue #2868 identified a regression where plain str inputs were coerced as file/path values. This change narrows coercion to explicit typing while preserving prior fallback behavior if type hint resolution fails.

Notes

• no public API changes
• behavior is stricter when type hints resolve, and backward-compatible when hint resolution fails

[markphelps]

thank you for the contribution @erayack !! going to close this in favor of #2872 as we discussed, but looking forward to the PR for the PEP 604 union handling