I found the cause of this: it was nginx sanitising the double slash out of the URL for the API call.
(I was using nginx as the web server for v5, switched to nginx reverse proxy for v6, supports my particular HTTPS setup.)
Adding merge_slashes off;
to the server context of nginx config turned off the sanitisation and allowed the API calls to go through normally, which allows the list management to work as expected.
Source: nginx: How to keep double slashes in urls - Stack Overflow
API call after applying this, note correctly formatted list URL:
2025-04-23 09:36:31.407 AEST [22678/T22709] DEBUG_API: Requested API URI: ::1 -> PUT /api/lists/https://v.firebog.net/hosts/Prigent-Malware.txt ? type=block (Content-Type application/json; charset=utf-8)
2025-04-23 09:36:31.407 AEST [22678/T22709] DEBUG_API: Received payload with size: 81
2025-04-23 09:36:31.408 AEST [22678/T22709] DEBUG_API: Read sid=[redacted] from cookie
2025-04-23 09:36:31.408 AEST [22678/T22709] DEBUG_API: Recognized known user: user_id 0, valid_until: 2025-04-23 10:06:31 AEST, remote_addr ::1 (::1 at login)
2025-04-23 09:36:31.408 AEST [22678/T22709] DEBUG_API: Processing PUT /api/lists/https://v.firebog.net/hosts/Prigent-Malware.txt in /api/lists
2025-04-23 09:36:31.428 AEST [22678/T22709] DEBUG_API: SQL: INSERT INTO adlist (address,enabled,comment,type) VALUES (:item,:enabled,:comment,:type) ON CONFLICT(address,type) DO UPDATE SET enabled = :enabled, comment = :comment, type = :type;
2025-04-23 09:36:31.428 AEST [22678/T22709] DEBUG_API: :item = "https://v.firebog.net/hosts/Prigent-Malware.txt"
2025-04-23 09:36:31.428 AEST [22678/T22709] DEBUG_API: :type = 0
2025-04-23 09:36:31.428 AEST [22678/T22709] DEBUG_API: :comment = "Fabrice Prigent Malware"
2025-04-23 09:36:31.428 AEST [22678/T22709] DEBUG_API: :enabled = 0
2025-04-23 09:36:31.429 AEST [22678/T22709] DEBUG_API: SQL: SELECT id FROM adlist WHERE address = :item AND type = :type
2025-04-23 09:36:31.429 AEST [22678/T22709] DEBUG_API: :item = "https://v.firebog.net/hosts/Prigent-Malware.txt"
2025-04-23 09:36:31.429 AEST [22678/T22709] DEBUG_API: :type = "0"
2025-04-23 09:36:31.440 AEST [22678/T22709] DEBUG_API: SQL: DELETE FROM adlist_by_group WHERE adlist_id = :id;
2025-04-23 09:36:31.440 AEST [22678/T22709] DEBUG_API: :id = "21"
2025-04-23 09:36:31.441 AEST [22678/T22709] DEBUG_API: groupscount = 1
2025-04-23 09:36:31.455 AEST [22678/T22709] DEBUG_API: INSERT: 101 -> (21,0)
2025-04-23 09:36:31.455 AEST [22678/T22709] DEBUG_API: SQL: INSERT INTO adlist_by_group (adlist_id,group_id) VALUES (:id,:gid);
2025-04-23 09:36:31.455 AEST [22678/T22709] DEBUG_API: :id = "21"
2025-04-23 09:36:31.456 AEST [22678/T22709] DEBUG_API: :gid = "0"
2025-04-23 09:36:31.456 AEST [22678/T22709] DEBUG_API: SQL: SELECT id,type,address,enabled,date_added,date_modified,comment,(SELECT GROUP_CONCAT(group_id) FROM adlist_by_group g WHERE g.adlist_id = a.id) AS group_ids,date_updated,number,invalid_domains,status,abp_entries FROM adlist a WHERE type = 0 AND address = :item;
2025-04-23 09:36:31.457 AEST [22678/T22709] DEBUG_API: :item = "https://v.firebog.net/hosts/Prigent-Malware.txt"
2025-04-23 09:36:31.457 AEST [22678/T22709] DEBUG_API: :ids = "(null)"
2025-04-23 09:36:31.460 AEST [22678/T22709] DEBUG_API: Done
Sorry for all the bother, but glad to get it working.