fix(security): SSRF protection for alarm webhooks (FLAW-05)

Discord and custom webhook URLs are checked when saved and before every
call: https only, Discord URLs must point to discord.com. A guarded HTTP
client resolves hosts itself and connects only to allowed IPs; localhost,
link-local and cloud metadata are always blocked, LAN ranges (incl.
Tailscale CGNAT) and plain http only with the new admin switch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/types.ts

@@ -178,6 +178,7 @@ export interface SystemSettings {
   smtpFrom?: string;
   smtpTls?: boolean;
   smtpSkipVerify?: boolean;
+  allowPrivateWebhooks?: boolean; // alarm webhooks may reach the LAN (and plain http)
   smtpConfiguredViaEnv?: boolean;
 }