guard Yuanbao media URL downloads

[afurm]

Summary

• apply URL safety checks before Yuanbao media downloads create an HTTP client
• install a redirect guard for followed media redirects
• keep Yuanbao-resolved resource hosts as an explicit opt-in path for private-IP resolution while preserving metadata endpoint blocking

Tests

• .venv/bin/python -m pytest -o addopts='' tests/gateway/test_yuanbao_media.py tests/gateway/platforms/test_yuanbao_recall_db_only.py tests/test_yuanbao_pipeline.py tests/test_yuanbao_markdown.py tests/test_yuanbao_proto.py

[alt-glitch]

Duplicate of #22340 — both add SSRF guards (url_safety check + redirect guard) to Yuanbao media downloads. #22340 was opened first and is already triaged.

[afurm]

Thanks for flagging it. I missed #22340; closing this one as a duplicate.