fix(api): reject private IP literals before proxy dispatch - #4273

Problem

When PROXY_SERVER is configured, the safeFetch connection check sees the
proxy socket's remoteAddress, not the requested destination. A private IP
literal is blocked without a proxy but can reach the dispatcher when the proxy
itself has a public address.

The controlled API reproduction used the same
http://127.0.0.1:9911/secret target in both cases. The direct request was
blocked and did not reach the target. Through a restricted researcher-owned
proxy, the request reached the target and returned its marker.

Change

Add a destination interceptor before ProxyAgent dispatch. It rejects private
IPv4 and IPv6 literals on the initial request and redirects, using the existing
InsecureConnectionError. ALLOW_LOCAL_WEBHOOKS=true remains the explicit
opt-in for local destinations.

The interceptor does not resolve hostnames locally. A proxy can use a different
DNS view, so proxy-side DNS and rebinding protection are still required.

Validation

• git diff --check
• Prettier on the changed source and test
• Vitest: 5/5 passing
  • IPv4 loopback rejected
  • bracketed IPv6 loopback rejected
  • public IP literal allowed
  • ALLOW_LOCAL_WEBHOOKS=true allowed
  • composed 302 redirect to a private IP literal rejected with zero target hits

This is a defense-in-depth change and does not replace the documented
requirement for a proxy that blocks private and link-local destinations.

Summary by cubic

Block private IP literal targets in safeFetch before ProxyAgent dispatch to close a proxy bypass gap, including during redirects. ALLOW_LOCAL_WEBHOOKS=true still allows local targets.

• Bug Fixes
  • Added rejectPrivateIPLiteralTargets undici interceptor to reject private IPv4/IPv6 literals with InsecureConnectionError.
  • Composed before the redirect interceptor so checks re-run on each redirect; does not resolve hostnames locally (proxy must still filter hostnames).
  • Added tests for IPv4/IPv6 loopback rejection, public IP acceptance, ALLOW_LOCAL_WEBHOOKS opt-in, and blocking redirects to private targets without reaching them.

^{Written for commit c38f8ab. Summary will update on new commits.}