fix(web_fetch): block non-public targets by default and gate every hop

kigi allowed loopback unconditionally and missed several non-public
ranges, and the SSRF check ran only on the initial URL.

Policy (ssrf.rs):
- loopback is blocked unless `[toolset.web_fetch] allow_local` (or
  KIGI_WEB_FETCH_ALLOW_LOCAL) is on, AND the URL names it explicitly,
  so a public name resolving to loopback stays blocked (DNS rebinding)
- add 0.0.0.0/8, 100.64/10, 192.0.0.0/24, TEST-NET-1/2/3, 198.18/15,
  240/4, IPv6 site-local and documentation prefixes
- inherit the IPv4 verdict through mapped, compatible, NAT64 and 6to4
  wrappers; network-specific NAT64 prefixes remain uncovered (see doc)

Plumbing (client.rs), where the exploitable half lived:
- re-check every redirect hop, not just the first
- compare hosts exactly; a `www` sibling has its own A records, so it
  is a cross-host redirect rather than an auto-followed hop
- run the check before the fetch service, so a blocked URL is never
  posted to an endpoint that egresses elsewhere
- exempt explicit local hosts from the https upgrade and from the
  single-label filter, and re-upgrade each followed hop

Wiring: allow_local reaches WebFetchParams from both construction
paths; documented in the config guide and the README env table.

crates/codegen/kigi-shell/src/tools/config.rs

@@ -108,6 +108,10 @@ pub struct WebFetchToolConfig {
     /// default allowlist. An explicit empty list blocks all fetches.
     /// Resolution: TOML > remote settings > built-in defaults.
     pub allowed_domains: Option<Vec<String>>,
+    /// Allow fetches to explicit loopback hosts only (`localhost` /
+    /// `127.0.0.0/8` / `::1`). Private and metadata ranges stay blocked.
+    /// Resolution: TOML > `KIGI_WEB_FETCH_ALLOW_LOCAL` env > false.
+    pub allow_local: Option<bool>,
 }
 
 impl WebFetchToolConfig {
@@ -137,10 +141,15 @@ impl WebFetchToolConfig {
             .cloned()
             .or_else(|| remote_domains.map(|d| d.to_vec()));
 
+        let allow_local = self
+            .allow_local
+            .or_else(|| kigi_config::env_bool("KIGI_WEB_FETCH_ALLOW_LOCAL"));
+
         kigi_tools::implementations::kigi::web_fetch::WebFetchParams {
             proxy_endpoint,
             allowed_domains,
             context_window_tokens,
+            allow_local,
             ..Default::default()
         }
     }
@@ -484,6 +493,7 @@ mod tests {
         let local = WebFetchToolConfig {
             proxy_endpoint: Some("https://toml-proxy.example.com".to_owned()),
             allowed_domains: Some(vec!["toml.example.com".to_owned()]),
+            allow_local: Some(true),
         };
         let params = local.resolve_params(
             Some("https://remote-proxy.example.com"),
@@ -498,6 +508,7 @@ mod tests {
             params.allowed_domains,
             Some(vec!["toml.example.com".to_owned()])
         );
+        assert!(params.allow_local(), "the opt-in must reach the tool");
     }
 
     #[test]
@@ -524,6 +535,7 @@ mod tests {
         let params = local.resolve_params(None, None, None);
         assert!(params.proxy_endpoint.is_none());
         assert!(params.allowed_domains.is_none());
+        assert!(!params.allow_local(), "local access is off by default");
     }
 
     #[test]
@@ -531,6 +543,7 @@ mod tests {
         let local = WebFetchToolConfig {
             proxy_endpoint: None,
             allowed_domains: Some(vec![]),
+            allow_local: None,
         };
         let params = local.resolve_params(None, Some(&["remote.example.com".to_owned()]), None);
         assert_eq!(params.allowed_domains, Some(vec![]));