fix(webfetch): manual redirect loop with SSRF + cross-host guard

[RowitZou]

Problem

web-fetch-http.ts previously set axios `maxRedirects:10` and trusted the adapter to follow any 3xx Location header blindly. The permission card gates only the initial hostname — any redirect could land on:

• Cloud metadata IPs (`169.254.169.254` AWS / `100.100.100.200` Alibaba) and exfil instance credentials
• RFC1918 / loopback / link-local addresses behind a corp proxy
• A different public hostname the user never approved

The tool_result's `finalUrl` showed where the chain ended, but by then the daemon had already issued the request and (for binary downloads) persisted bytes to `.lightclaw/downloads/`. SSRF-like.

What this PR does

Replaces axios's built-in redirect-follow with manual loop + classify-each-hop:

1. Manual redirect loop in web-fetch-http.ts

• `maxRedirects: 0` + `validateStatus` widened to accept 3xx
• Per-hop check, max 10 hops, retries 5xx via existing `withWebRetry`
• New `DaemonFetchResult.redirectChain: string[]` field — captures every visited URL

2. SSRF hard-block (mode-independent)

`classifyRedirectTarget(url)` rejects when the destination's hostname resolves to:

• IPv4: 0/8, 10/8, 100.64/10 (CGNAT, incl. Alibaba metadata `100.100.100.200`), 127/8 (loopback), 169.254/16 (link-local + AWS/Azure/GCP metadata), 172.16/12, 192.0.0/24, 192.168/16, 198.18/15
• IPv6: `::1`, fc00::/7 (ULA), fe80::/10 (link-local), IPv4-mapped IPv6 in both dotted and Node's canonical hex form (`::ffff:a9fe:a9fe`)
• Hostname aliases: `localhost` / `*.localhost`
• Non-HTTP(S) schemes: file:// / gopher:// / ftp://

Throws `SsrfRedirectError`. Mode-independent — blocked even in `acceptEdits`/auto mode.

3. Strict same-host follow

Any hostname change throws `CrossHostRedirectError` with the would-be target captured in the chain. The model's recovery: re-issue `WebFetch()` directly, which goes through the normal per-hostname permission flow (auto-allowed in auto mode via existing `policy.ts:119`; card in default mode).

4. Permission-card surface is unchanged

The fix lives entirely in the daemon-fetch layer; it never calls `requestPermission()` and never introduces a new card path. Per the user's explicit constraint: auto mode stays card-free — the existing WebFetch auto-allow rule still applies to all hostnames (initial + cross-host re-issues).

Out of scope for V1 (gaps documented in code header)

• DNS resolution of named hosts to catch internal hostnames that resolve to private IPs. The cross-host rule catches the typical named-internal case because the hostname differs from the user-approved initial host. Defer until proxy-fronted env has a dogfood signal.
• Same-registrable-domain follow (`docs.foo.com → static.foo.com`) and short-link whitelist (`t.co` / `bit.ly`). Strict same-host is the safest default; relax after dogfood shows it's a real annoyance.
• DNS rebinding defense via per-hop IP pinning. The static-IP-literal SSRF case (the high-value cloud-metadata vector) is fully covered.

Test plan

• Existing 308 same-host trailing-slash case rewritten — axios no longer auto-follows; test now drives two stubbed responses and asserts manual loop + chain
• New cases (20 total):
  • same-host single redirect + multi-hop chain captured
  • cross-host redirect throws `CrossHostRedirectError` + target never fetched (the actual security property)
  • SSRF: AWS metadata / RFC1918 / loopback / Alibaba / localhost / non-HTTP scheme all throw `SsrfRedirectError`
  • max-hops loop throws `RedirectLimitError`
  • 3xx without Location → `AxiosError` surfaced
  • Existing 4xx-not-retried / timeout / 503-retry / socket-reset retry cases all preserved unchanged
  • `classifyRedirectTarget` exhaustive: ordinary public IPs pass; all private ranges block; IPv6 ULA / link-local / IPv4-mapped IPv6 (both forms) / non-HTTP schemes / unparseable URLs
• `pnpm typecheck` clean
• `pnpm test` 1442/1442 PASS (1422 baseline + 20 new)

🤖 Generated with Claude Code