test(web): lock SSRF resolution-bypass cases (IPv6 spelling + public sibling DNS)

[groupthinking]

Summary

`apps/web/src/lib/ssrf-guard.ts` correctly rejects private destinations that hide behind alternate IPv6 spellings or public sibling DNS records, but nothing on `main` asserts those paths. A regression would be silent: `assertPublicHttpUrl` would return a URL and the caller would fetch it.

Acceptance

• Dedicated regression tests cover at least:
  1. Private destination via alternate IPv6 spelling must reject
  2. Private destination behind a public sibling DNS record must reject
• Tests target the merged API on `main` (no dependency on the superseded `SsrfGuardError` shape from test(security): cover SSRF private-address detection main's tests miss #1428)
• No production behavior change — tests only

Context

Detection cases salvaged from #1428 after #1381 landed the security outcome first. Related: #1484 / #1486 (IPv6 literal range-check + first module tests).

[linear-code]

GRV-386

[coderabbitai]

🔗 Related PRs

#274 - test(e2e): harden withBypass header merge against non-object HeadersInit [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[groupthinking]

Closed: the resolution-bypass cases were already landed by #1428 (merged 2026-08-07 as 75ef3ca). #1483 was a duplicate salvage and was closed without merge. #1486 still adds the IPv6 literal range-check + broader module tests.