fix: block non-public URL targets

[fly1d]

What changed

• Reject link-local, shared, reserved, documentation, multicast, and other non-public IPv4 targets before fetching.
• Reject IPv6 loopback, ULA, link-local, site-local, documentation, multicast, and embedded private IPv4 targets.
• Add regression coverage for cloud metadata and IPv4-mapped IPv6 URLs.

Risk

• Low: copy, styles, documentation, or isolated cleanup
• Medium: interaction, API response, or shared behavior
• High: fetching, security boundary, deployment, or data compatibility

Verification

• npm run ci passes locally
• I tested the main user path affected by this change
• I checked desktop/mobile layout when UI changed
• I added or updated tests for behavior changes
• I documented anything intentionally not tested

Verification notes:

Local lint and all 6 smoke tests pass. The UI is unchanged, so desktop/mobile layout testing is not applicable.

Review and release

• The diff is focused and contains no unrelated changes
• Error, empty, loading, and recovery states were considered
• Security and privacy impact was considered
• Rollback is understood

Rollback plan:

Revert this PR. No data migration or deployment step is involved.

[fly1d]

Code review completed: no blocking findings in this focused change. CIDR boundaries, IPv4-mapped IPv6 handling, redirects, error behavior, and regression coverage were reviewed. GitHub Smoke passed. Residual DNS-rebinding risk predates this PR and is tracked separately so this address-range fix can remain focused.