Unauthenticated SSRF via unvalidated HTTP redirects (single-shot SSRF gate not re-applied per redirect hop)

### Summary

Reader validates the user-supplied URL once via `MiscService.assertNormalizedUrl`, which resolves the hostname and rejects non-public IP ranges. After that single check the fetch follows HTTP redirects with no per-hop re-validation, so an attacker-controlled public host can 30x-redirect Reader into the internal network or the cloud metadata endpoint, and the redirect target's body is returned to the caller. Both the curl/sideLoad path and the browser path are affected. Confirmed against the compiled `CurlControl` with the production SSRF guard active: an internal secret was exfiltrated through a redirect, and the IP guard was never consulted on the redirect hop.

### Details

The only SSRF gate, `assertNormalizedUrl` (`src/services/misc.ts:36-124`), validates the initial URL once via `isIPInNonPublicRange` (`src/utils/ip.ts:158`). The fetch paths then follow redirects without re-checking:

1. curl/sideLoad path (`src/services/curl.ts`): `urlToFile` (~315-398) and `urlToBlob` (~456-552) manually follow redirects (`FOLLOWLOCATION` off, ~139) via `nextHopUrl = new URL(location || '', nextHopUrl)` (~376, ~521) and loop back into `urlToStream` with zero calls to `assertNormalizedUrl`/`isIPInNonPublicRange` on any hop. Reached from `CrawlerHost` via `curlControl.sideLoadBlob(...)` (`src/api/crawler.ts:1075`, `:1123`) on the default AUTO engine and explicitly via `engine=curl`.

2. Browser path (`src/services/puppeteer.ts:865-956`): the request interceptor governing nav, redirects, and sub-resources only blocks `localhost` and `127.*` (~917-926), never the full-range `isIPInNonPublicRange`, so `169.254.169.254`, `10.x`, `192.168.x`, `172.16.x`, `0.0.0.0`, `[::1]`, decimal `2130706433`, etc. are reachable in-browser.

A secondary precedence bug in the gate (`src/services/misc.ts:70-74`) parses as `(privateIpNotAcceptable && hostname==='localhost') || (isIp && isIPInNonPublicRange(...))`, so the literal-IP branch ignores the `privateIpNotAcceptable` flag.

The boundary crossed is an unauthenticated network attacker supplying a URL whose attacker-public host redirects to an internal-only IP/metadata endpoint, whose response body is read back to the attacker. Caveat: the private-IP protections are gated by `privateIpNotAcceptable = NODE_ENV~=prod && GCLOUD_PROJECT` (`src/services/misc.ts:15`), i.e. the hosted production config; the PoC forced that flag ON to prove the bypass survives the production guard.

### PoC

```
[env] privateIpNotAcceptable = true
attacker URL http://127.0.0.1:44547/start -> 302 Location: http://127.0.0.1:43679/latest/meta-data/iam/security-credentials
CURL [302] http://127.0.0.1:44547 -> CURL [200] http://127.0.0.1:43679
final status: 200
returned body: "SSRF-REACHED-INTERNAL secret=INTERNAL-METADATA-TOKEN-nifd3ztxsq path=/latest/meta-data/iam/security-credentials"
isIPInNonPublicRange invocations during redirect-follow: 0
>>> INTERNAL TARGET REACHED VIA REDIRECT: true
```

The internal secret was exfiltrated through the redirect with the production SSRF guard active and never consulted on the redirect hop.

### Impact

An unauthenticated client of a Reader instance reads internal-only services and cloud instance-metadata credentials by supplying a URL that an attacker-controlled public host redirects to an internal address. Scope is changed (pivot into the internal network / metadata credential theft).

### Remediation

Re-run the full validation (`assertNormalizedUrl`/`isIPInNonPublicRange`) on every redirect hop in `urlToFile`/`urlToBlob` before issuing `urlToStream(nextHopUrl, ...)`, and pin the connection to the validated IP (curl `RESOLVE` or a socket-open callback rejecting non-public sockets) to also close DNS rebinding. In the puppeteer interceptor (~917), replace the `localhost`/`127.*` substring check with `isIP(host) && isIPInNonPublicRange(host)` plus a DNS-resolve-and-check for hostnames. Fix the `&&`/`||` precedence in `misc.ts:70-74`.

Affected Versions: confirmed on current main (commit 1574bfd)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L (8.3 High)
CWE: CWE-918 Server-Side Request Forgery (with CWE-697 incomplete comparison)