Security: close Python poller link-check DNS rebinding gap

[CryptoJones]

Problem

applytrack.linkcheck resolves a host and checks that all addresses are public, then lets httpx connect by hostname. DNS can change between check and use.

Impact

A malicious listing URL may race DNS rebinding and make the poller connect to private/internal services during link verification.

References

• src/applytrack/linkcheck.py
• API-side stronger reference: api/ApplyTrack.Api/Scrape/JobPageFetcher.cs

Acceptance criteria

• Poller link verification connects to a previously validated public IP, or uses an equivalent no-TOCTOU mechanism.
• Redirect hops are revalidated with the same protection.
• Tests cover private IPs, embedded IPv4 IPv6 forms, redirects, and rebinding-style behavior where practical.