Harden security: SSRF guard on all outbound fetches, auth fixes

- Route image-validation, Matrix image-download, and wayback/archive.today
  fetches through safehttp so feed-controlled URLs can't reach loopback/
  RFC1918/cloud-metadata IPs (incl. via redirects).
- Cap feed body size with safehttp.LimitedBody (16 MiB) to prevent OOM.
- Fail closed if matrix.pickle_key is unset/<16 chars; drop the hardcoded
  "pete_pickle_key" default that silently weakened E2EE-at-rest.
- Gate !post behind a matrix.admins allowlist; empty = disabled (channel
  rooms are public, so empty must not mean anyone).
- Reject /\host open-redirect bypass in post-login safeNext.
- Allowlist http(s) schemes for the Matrix link href; escape JSON embedded
  in inline <script> (prefs/sources blobs).

internal/config/config_test.go

@@ -12,6 +12,7 @@ const validMatrix = `
 homeserver = "https://matrix.example.org"
 user_id = "@pete:example.org"
 password = "testpass"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!tech:example.org"
 politics = "!politics:example.org"
@@ -57,6 +58,7 @@ func TestEnvVarExpansion(t *testing.T) {
 homeserver = "https://matrix.example.org"
 user_id = "@pete:example.org"
 password = "${TEST_PETE_PASS}"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!tech:example.org"
 
@@ -114,6 +116,7 @@ func TestValidationErrors(t *testing.T) {
 [matrix]
 user_id = "@p:h"
 password = "pw"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!t:e"
 [storage]
@@ -123,6 +126,7 @@ db_path = "/tmp/t.db"
 [matrix]
 homeserver = "https://h"
 password = "pw"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!t:e"
 [storage]
@@ -142,6 +146,7 @@ db_path = "/tmp/t.db"
 homeserver = "https://h"
 user_id = "@p:h"
 password = "pw"
+pickle_key = "test_pickle_key_1234"
 [storage]
 db_path = "/tmp/t.db"
 `},
@@ -150,6 +155,7 @@ db_path = "/tmp/t.db"
 homeserver = "https://h"
 user_id = "@p:h"
 password = "pw"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!t:e"
 [storage]
@@ -159,6 +165,7 @@ tech = "!t:e"
 homeserver = "https://h"
 user_id = "@p:h"
 password = "pw"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!t:e"
 [storage]
@@ -176,6 +183,7 @@ enabled = true
 homeserver = "https://h"
 user_id = "@p:h"
 password = "pw"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!t:e"
 [storage]
@@ -192,6 +200,7 @@ enabled = true
 homeserver = "https://h"
 user_id = "@p:h"
 password = "pw"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!t:e"
 [storage]
@@ -225,6 +234,7 @@ func TestDisabledSourceSkipsDirectRouteCheck(t *testing.T) {
 homeserver = "https://h"
 user_id = "@p:h"
 password = "pw"
+pickle_key = "test_pickle_key_1234"
 [matrix.channels]
 tech = "!t:e"
 [storage]