fix: validate upload proxy target URL to prevent SSRF abuse

[MD-Mushfiqur123]

Problem

The /api/upload-binary and /api/v1/upload-binary endpoints accept a x-proxy-target-url field from client form data and perform a server-side fetch to that URL. Since the value originates from client-controlled input, an attacker could set it to an internal address (e.g., http://169.254.169.254/ for cloud metadata, http://localhost:8080/ for internal services) and abuse the server as an open relay.

Fix

Added isUnsafeTarget() validation to both upload-binary routes that:

1. Requires HTTPS — rejects any non-HTTPS URL
2. Blocks internal/reserved IP ranges — rejects hostnames matching RFC 1918 private ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), link-local (169.254.x.x), loopback (127.x.x.x, ::1), and localhost

Invalid URLs return HTTP 400 with "Invalid or unsafe proxy target URL" instead of being forwarded.

Impact

• ✅ SSRF risk mitigated — internal services can no longer be targeted via the upload proxy
• ✅ Backward compatible — legitimate S3 uploads (always HTTPS, public hostnames) pass validation
• ✅ Minimal change — ~15 lines of validation logic per route file

Fixes #162