Resolve hosts to IPs and reject private/reserved/link-local ranges (incl.
169.254 cloud metadata) instead of matching hostname text, and re-validate
every redirect hop by following them manually. Restrict curl to http(s).
vtt-proxy allowlist now requires an exact host or a real subdomain.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>