feat: nightly hardening - SSRF-safe remote profile loading

[mouse-value-add]

Problem

loadFromUrl accepted any HTTPS host and trusted fetch redirect behavior without validating the final destination. That left a gap where user-supplied URLs could target local/private network endpoints (or redirect into them), increasing SSRF risk in downstream consumers.

Approach

• Added hostname/IP hardening to reject local/private targets before network calls:
  • localhost and .localhost
  • .local hostnames
  • RFC1918 IPv4 ranges, loopback, link-local, and 0.0.0.0/8
  • IPv6 loopback (::1), ULA (fc00::/7), and link-local (fe80::/10)
• Added redirect hardening to validate response.url and reject:
  • redirects to non-HTTPS URLs
  • redirects to local/private network addresses
• Added parser tests for both direct local/private target rejection and redirect rejection.

Verification

• npm test
• npm run lint
• npm run build

Risks

• Some legitimate internal enterprise profile endpoints (private network or .local) will now be blocked by default.

Rollback plan

• Revert commit c23b88c (or this PR) to restore previous URL fetching behavior.