fix(security): SSRF protection for alarm webhooks (FLAW-05)

Discord and custom webhook URLs are checked when saved and before every
call: https only, Discord URLs must point to discord.com. A guarded HTTP
client resolves hosts itself and connects only to allowed IPs; localhost,
link-local and cloud metadata are always blocked, LAN ranges (incl.
Tailscale CGNAT) and plain http only with the new admin switch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/models.go

@@ -278,17 +278,20 @@ type TeamMember struct {
 }
 
 type SystemSettings struct {
-	SharingMode          string `json:"sharingMode"` // private | organizations | open
-	AllowRegistration    bool   `json:"allowRegistration"`
-	InstanceName         string `json:"instanceName"`
-	SMTPHost             string `json:"smtpHost"`
-	SMTPPort             string `json:"smtpPort"`
-	SMTPUser             string `json:"smtpUser"`
-	SMTPPass             string `json:"smtpPass"`
-	SMTPFrom             string `json:"smtpFrom"`
-	SMTPTLS              bool   `json:"smtpTls"`
-	SMTPSkipVerify       bool   `json:"smtpSkipVerify"` // accept self-signed certificates
-	SMTPConfiguredViaEnv bool   `json:"smtpConfiguredViaEnv,omitempty"`
+	SharingMode       string `json:"sharingMode"` // private | organizations | open
+	AllowRegistration bool   `json:"allowRegistration"`
+	InstanceName      string `json:"instanceName"`
+	SMTPHost          string `json:"smtpHost"`
+	SMTPPort          string `json:"smtpPort"`
+	SMTPUser          string `json:"smtpUser"`
+	SMTPPass          string `json:"smtpPass"`
+	SMTPFrom          string `json:"smtpFrom"`
+	SMTPTLS           bool   `json:"smtpTls"`
+	SMTPSkipVerify    bool   `json:"smtpSkipVerify"` // accept self-signed certificates
+	// AllowPrivateWebhooks lets alarm webhooks reach LAN addresses (and plain http); localhost and cloud
+	// metadata stay blocked
+	AllowPrivateWebhooks bool `json:"allowPrivateWebhooks"`
+	SMTPConfiguredViaEnv bool `json:"smtpConfiguredViaEnv,omitempty"`
 }
 
 // UnmarshalJSON accepts smtpPort as text or number: older clients sent a number, which made the whole