fix: pin validated DNS addresses

[fly1d]

What changed

• Move URL validation and fetching into a focused, directly testable module.
• Replace the second untrusted DNS lookup with a native HTTP/HTTPS connection pinned to the previously validated addresses.
• Resolve and pin every redirect destination independently, then verify the actual connected socket remains public.
• Add no-network regression tests for DNS rebinding, redirects, mixed DNS answers, socket validation, and address boundaries.

Closes #4

Risk

• Low: copy, styles, documentation, or isolated cleanup
• Medium: interaction, API response, or shared behavior
• High: fetching, security boundary, deployment, or data compatibility

Verification

• npm run ci passes locally
• I tested the main user path affected by this change
• I checked desktop/mobile layout when UI changed
• I added or updated tests for behavior changes
• I documented anything intentionally not tested

Verification notes:

All 11 local checks pass. A real fetch of https://example.com/ also succeeded with TLS hostname validation, a 559-byte body, and the expected title. UI layout is unchanged.

Review and release

• The diff is focused and contains no unrelated changes
• Error, empty, loading, and recovery states were considered
• Security and privacy impact was considered
• Rollback is understood

Rollback plan:

Revert this PR. No data migration or dependency change is involved.

[fly1d]

Code review completed with no blocking findings. Verified: validated DNS answers are passed into the native connection lookup; redirect hosts are independently resolved and pinned; the connected socket address is checked; public IPv4/IPv6 boundaries remain allowed; no dependency was added; all 11 tests and the real HTTPS fetch pass.