fix(security): remove open SSRF proxy and add endpoint validation

[aglichandrap]

Summary

Fixes IntersectMBO/govtool#4168 — Unauthenticated Open SSRF Proxy (CVSS 9.1 Critical)

Vulnerability

The POST /api/proxy endpoint was a fully open, unauthenticated HTTP proxy. Any attacker could send a single POST request and make the server fetch any URL, controlling the HTTP method, headers, query parameters, and request body. This enabled:

• Cloud credential theft (AWS/GCP/Azure instance metadata)
• Internal network traversal (database, internal APIs)
• Arbitrary request forgery (POST/PUT/DELETE to internal services)

Changes

Critical fix — Remove open SSRF proxy:

• Removed the forward() handler from backend/src/api/proxy/controllers/proxy.js
• Removed the POST /proxy route from backend/src/api/proxy/routes/proxy.js
• This endpoint was dead code — the frontend only uses /api/proxy/govtool/... routes

Hardening — Validate govtool proxy endpoints:

• Added validateEndpoint() helper that rejects:
  • Absolute URLs (http://, https://)
  • Protocol-relative URLs (//)
  • Path traversal sequences (..)
  • Null bytes and backslashes
• Applied validation to both getGovtoolData and postGovtoolData handlers
• Added GOVTOOL_API_BASE_URL null check with proper error response
• Enabled Authorization header forwarding when GOVTOOL_API_TOKEN is configured

Hardening — Fix govtool-proxy endpoint:

• Applied the same SSRF protections to backend/src/api/govtool-proxy/controllers/govtool-proxy.js
• Removed console.log(fullUrl) that leaked URLs to server logs
• Translated Serbian comments to English

Impact

Before	After
Any user can proxy to any URL	Proxy only forwards to configured GOVTOOL_API_BASE_URL
POST /api/proxy accepts arbitrary URLs	Route removed entirely
Path traversal possible via endpoint param	.., \, null bytes, absolute URLs all rejected
No upstream auth headers	GOVTOOL_API_TOKEN forwarded when configured

Testing

The SSRF mitigation can be verified with these curl commands (should all return 400):

curl -X POST https://<host>/api/proxy -d "{}" 
# Expected: 404 (route removed)

curl https://<host>/api/proxy/govtool/http://169.254.169.254/latest/meta-data/
# Expected: 400 "Absolute URLs are not allowed"

curl https://<host>/api/proxy/govtool/../../etc/passwd
# Expected: 400 "Path traversal is not allowed"

curl https://<host>/api/proxy/govtool/\\internal-host:8080/
# Expected: 400 "Backslashes are not allowed"

Fixes #4168