fix(security): C6 — extend SSRF block to RFC-1918 + IMDS ranges

[HongmingWang-Rabbit]

Summary

• Extends validateAgentURL (introduced in PR fix(security): C6 — block loopback IP literals in /registry/register #94) to block all private IP ranges, not just link-local:
  • 10.0.0.0/8 — RFC-1918 class A
  • 172.16.0.0/12 — RFC-1918 class B (includes Docker bridge 172.17–31.x.x)
  • 192.168.0.0/16 — RFC-1918 class C
  • ::1/128 — IPv6 loopback
  • fc00::/7 — IPv6 unique-local (covers fd00::/8 sub-range)
• 169.254.0.0/16 (link-local / AWS IMDS) was already blocked; preserved.
• CIDRs pre-parsed into a package-level ssrfBlockedNets slice — no per-request ParseCIDR cost.
• Hostname-based URLs are resolved via DNS before the check; DNS failures are fail-open (don't block legitimate registrations).

What changed

File	Change
platform/internal/handlers/registry.go	Added ssrfBlockedNets var; rewrote validateAgentURL to iterate all blocked ranges + DNS resolve
platform/internal/handlers/registry_test.go	Flipped 3 incorrect "RFC-1918 is valid" cases; added 15 new boundary/IPv6 sub-cases
platform/internal/handlers/handlers_test.go	Changed http://localhost: fixture URLs to http://127.0.0.1: (DNS-safe for this environment)

Relation to PR #94

• Do not merge before PR fix(security): C6 — block loopback IP literals in /registry/register #94 — both target validateAgentURL. Once fix(security): C6 — block loopback IP literals in /registry/register #94 lands, the 127.0.0.1 test case in this PR should be updated to wantErr: true and a loopback CIDR added to ssrfBlockedNets.
• Alternatively, rebase this PR on top of fix(security): C6 — block loopback IP literals in /registry/register #94 and consolidate.

Test plan

• CGO_ENABLED=0 go test ./... — all packages pass
• 24 sub-cases in TestValidateAgentURL all pass (3 RFC-1918 ranges × 3 boundary IPs each + 3 IPv6 + existing link-local + scheme/input tests)
• All pre-existing registry/handler tests pass (no regressions)

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

⚠️ Needs update before merge — PR #94 already landed.

This branch was created before PR #94 merged. Three issues that must be fixed:

1. Missing 127.0.0.0/8 in ssrfBlockedNets — PR fix(security): C6 — block loopback IP literals in /registry/register #94 added loopback blocking. This PR's new function omits it, causing a regression. Add "127.0.0.0/8", // IPv4 loopback to the cidrs slice.

2. Test fixtures revert to http://127.0.0.1: — Main now uses http://localhost: in the handler test fixtures (changed by PR fix(security): C6 — block loopback IP literals in /registry/register #94). The diff shows this PR switching them back to 127.0.0.1, which will fail once loopback is in the blocked list.

3. Loopback test cases removed — Main now has wantErr: true for 127.0.0.x in TestValidateAgentURL. Those should be preserved.

Suggested path:

git rebase origin/main
# Resolve conflicts by keeping main's localhost fixtures
# Add "127.0.0.0/8" to ssrfBlockedNets
# Update wantErr for 127.0.0.1 test case to true

The DNS resolution + IPv6 + pre-parsed CIDR improvements are good and worth landing — they just need to build on top of the current main state.

[HongmingWang-Rabbit]

Superseded by #119 which takes the targeted approach: adds only the three IPv6 CIDRs (fe80::/10, ::1/128, fc00::/7) to the existing blockedRanges without removing the loopback and RFC-1918 IPv4 blocks that this PR's ssrfBlockedNets var omitted.