feat: Add configurable SSRF host and CIDR allowlists

[chenyme]

Summary

Add configurable SSRF allowlists for trusted internal integrations while preserving strict protection for user-, model-, and provider-derived URLs.

The implementation centralizes outbound policy construction, validates all DNS results before dialing, preserves the same policy across redirects, and permanently blocks metadata, link-local, multicast, and unspecified targets.

Fix: #556

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• go test ./...
• pnpm --filter @deeix/api check
• pnpm --filter @deeix/api build
• pnpm verify
• git diff --check

Screenshots, API examples, or logs

Not applicable. This change has no frontend UI changes or public API schema changes.

Configuration, migration, and compatibility notes

Added:

• SSRF_ALLOWED_HOSTS: exact trusted hostnames or container names, comma-separated.
• SSRF_ALLOWED_CIDRS: trusted IP ranges in CIDR notation, comma-separated.

The settings are independent and default to empty. No database migration is required. Configuration changes require a backend restart.

Trusted integration endpoints may use the configured allowlist. Media downloads, provider-generated URLs, and public catalog downloads continue using the strict outbound policy.

No secrets, credentials, or personal data are included.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

README files, configuration examples, backend security rules, layering rules, SDK references, checklists, and the backend feature template were updated.

Note: docs/rules/backend/* is currently excluded by .gitignore; those local rule files were updated but are not included in the Git diff unless the ignore policy is intentionally changed.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, provider routing, file processing, billing, MCP, DNS resolution, redirects, and outbound HTTP clients.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.