feat(security): add outbound SSRF protection to webhook and provider URLs (#640)

[JohnOluB]

Closes #640. Adds a two-layer SSRF protection system to every outbound URL Syncro makes — webhook delivery, provider APIs, calendar integrations — so private network endpoints and cloud metadata services can never be targeted.
Changes
backend/src/utils/ssrf-protection.ts (new)
The single source of truth for URL allow/deny rules:

validateOutboundUrl(url, options?) — async, performs DNS resolution to guard against DNS rebinding. Throws SSRFError with a typed code on failure.
validateOutboundUrlSync(url, allowHttp?) — sync variant for Zod .refine() callbacks; returns { valid, reason }.
ALLOWED_PROTOCOLS — https: only by default; http: gated behind explicit allowHttp option.
BLOCKED_HOSTNAMES — explicit blocklist for metadata.google.internal, metadata.goog, instance-data, instance-data.ec2.internal.
Private IPv4 ranges blocked: loopback 127.0.0.0/8, RFC-1918 (10/8, 172.16/12, 192.168/16), link-local/IMDS 169.254.0.0/16, CGNAT 100.64.0.0/10, TEST-NETs, reserved 240/4, broadcast.
Private IPv6 ranges blocked: ::1, fe80::/10, fc00::/7, IPv4-mapped ::ffff:x in both dotted-decimal and URL-normalised hex-group form.

backend/src/schemas/webhook.ts
Replaces the bare http/https protocol check with validateOutboundUrlSync — private IPs, IMDS hostnames, and blocked protocols are now rejected at schema validation time with a descriptive 400 before the request reaches any service code.
backend/src/services/webhook-service.ts
Adds validateOutboundUrl(webhook.url) immediately before the fetch() call in deliverWebhook(). If blocked, the delivery is recorded as a failure with SSRF_BLOCKED: in the response body for full auditability, and a warn log entry is emitted with the webhook ID, URL, and reason.
Tests
45 tests, all passing (backend/tests/ssrf-protection.test.ts):

Valid public HTTPS URLs ✓
Protocol enforcement (HTTP, FTP, file://, javascript:, data:) ✓
Malformed/empty URLs ✓
All blocked hostnames ✓
All private IPv4 CIDR ranges ✓
IPv6 loopback, link-local, unique-local ✓
IPv4-mapped IPv6 in both URL forms (::ffff:192.168.1.1 and ::ffff:c0a8:101) ✓
DNS rebinding simulation (hostname → private IP) ✓
DNS failure handling ✓
resolveDns: false bypass for tests ✓
Constants sanity checks ✓

Acceptance Criteria

URL allow/deny rules are defined (ALLOWED_PROTOCOLS, BLOCKED_HOSTNAMES, private IP ranges)
Private network and metadata endpoints are blocked (layer 1: schema; layer 2: pre-dispatch with DNS)
Validation is tested (45 tests)
No security regressions introduced
Documentation inline via JSDoc

[drips-wave]

@JohnOluB Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits