Redact SSRF DNS oracle details in ssrf-guard errors

[groupthinking]

Ensure unauthenticated SSRF URL rejections return a constant message while preserving specific DNS/private-address causes only in server logs (CWE-209).

[linear-code]

GRV-381

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• GRV-347
• fix(security): SSRF guard leaks a DNS oracle through /api/transcribe (CWE-209) #1427

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[groupthinking]

Closed as completed by #1381 (ssrf-guard rewrite on main). DNS-path rejections already collapse to the single caller-visible literal Host does not resolve to a public address; hostname, errno, and resolver text are retained only in server logs. Covered by ssrf-guard-dns-leakage.test.ts on main (and further locked by #1486 module tests when it lands).

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.