fix: block SSRF to loopback, private and cloud-metadata addresses

[rajarshidattapy]

What does this PR do?

Fixes #28.

validateURL only checked that a target parses, uses http/https, and has a non-empty
host. Nothing stopped /v1/scrape from fetching http://127.0.0.1:8080/health,
http://169.254.169.254/latest/meta-data/, or any RFC1918 address and returning the full
response body to the caller — cloud credentials and internal admin panels included. The
API has no authentication, so this is reachable by anyone who can reach port 8080.

Adds internal/netguard and wires it into the two places that reach the network:

• Boundary check — ScraperHandler.validateURL resolves the host and rejects internal
  addresses with 400 invalid_url. Covers /v1/scrape, /v1/url-scraper, and every URL
  in a batch. It is also the only protection available for the browser handler, whose
  dialer lives in the Camoufox process.
• Dial check — a net.Dialer Control hook on the HTTP handler's transport re-checks
  the post-resolution IP of every hop, so redirect chains and DNS rebinding are covered,
  which a one-shot hostname check cannot see. Installed only when no proxy is configured:
  behind a proxy the dial target is the proxy, which is legitimately private.

Blocked ranges: loopback, private (RFC1918 and fc00::/7), link-local (which covers the
169.254.169.254 metadata endpoint), unspecified, and multicast — including their
IPv4-mapped IPv6 forms. Operators who genuinely scrape internal sites can set
ALLOW_PRIVATE_TARGETS=true (default false; logs a warning at startup).

Deliberately out of scope:

• domain_configs.proxy_url is not restricted — private proxy addresses are a normal
  setup (PROXY_URL=http://127.0.0.1:8888) and blocking them would break valid configs.
  Attacker-written domain configs are the separate auth/CORS issue.
• Hosts that fail to resolve pass the boundary check: DNS failures are transient and
  unreachable names reach nothing, so the scrape fails with its real error rather than a
  spurious 400.
• The browser handler keeps a rebinding/redirect gap past the boundary check, documented
  in the package doc. Closing it needs an egress proxy in front of the browser service.

How to test

1. make up
2. Internal targets are refused:

   for u in http://127.0.0.1:8080/health http://169.254.169.254/latest/meta-data/ \
            http://10.0.0.1/ http://localhost:8080/health; do
     curl -s -X POST http://localhost:8080/v1/scrape \
       -H "Content-Type: application/json" -d "{\"url\":\"$u\"}"; echo
   done
   Each returns {"error":"invalid_url","message":"... is not a routable public address"}.
   localhost reports localhost resolves to ::1, ....

3. A batch containing one internal URL is rejected with the offending index:
   curl -s -X POST http://localhost:8080/v1/url-scraper/batch -H "Content-Type: application/json"
   -d '{"urls":["https://example.com","http://169.254.169.254/"]}'
4. Public scraping is unaffected:
   curl -s -X POST http://localhost:8080/v1/scrape -H "Content-Type: application/json"
   -d '{"url":"https://example.com"}' | jq .markdown
5. cd server && go test ./... — netguard_test.go covers the IP ranges, ValidateHost
   and DialControl; handler/http_test.go asserts the dialer guard is wired up by
   fetching an httptest loopback server with the flag off (blocked) and on (allowed).

Checklist

• Tests pass (cd server && go test ./...)
• No breaking changes to existing API endpoints
• Documentation updated (if applicable) — ALLOW_PRIVATE_TARGETS added to .env.example

One caveat worth keeping honest: go test -race couldn't run locally (needs cgo) — CI covers it. Behaviour change to flag in review: a previously-accepted internal URL now returns 400 at submit time instead of a job that fails later.