Harden security: SSRF guard on all outbound fetches, auth fixes

- Route image-validation, Matrix image-download, and wayback/archive.today
  fetches through safehttp so feed-controlled URLs can't reach loopback/
  RFC1918/cloud-metadata IPs (incl. via redirects).
- Cap feed body size with safehttp.LimitedBody (16 MiB) to prevent OOM.
- Fail closed if matrix.pickle_key is unset/<16 chars; drop the hardcoded
  "pete_pickle_key" default that silently weakened E2EE-at-rest.
- Gate !post behind a matrix.admins allowlist; empty = disabled (channel
  rooms are public, so empty must not mean anyone).
- Reject /\host open-redirect bypass in post-login safeNext.
- Allowlist http(s) schemes for the Matrix link href; escape JSON embedded
  in inline <script> (prefs/sources blobs).

internal/ingestion/wayback.go

@@ -7,9 +7,11 @@ import (
 	"net/url"
 	"strings"
 	"time"
+
+	"pete/internal/safehttp"
 )
 
-var waybackClient = &http.Client{Timeout: 10 * time.Second}
+var waybackClient = safehttp.NewClient(10 * time.Second)
 
 // maxSnapshotAge bounds how stale a Wayback snapshot can be before we treat
 // it as useless for a freshly-published news article. The "closest" snapshot
@@ -86,14 +88,16 @@ func snapshotFreshEnough(ts string) bool {
 	return time.Since(t) <= maxSnapshotAge
 }
 
-var archiveTodayClient = &http.Client{
-	Timeout: 10 * time.Second,
-	// Don't follow the redirect — we just want the Location header pointing
-	// at the most recent capture.
-	CheckRedirect: func(*http.Request, []*http.Request) error {
+// archiveTodayClient routes through safehttp for the dial-time SSRF guard, but
+// overrides CheckRedirect so we read the 302 Location header (the most recent
+// capture) instead of following it.
+var archiveTodayClient = func() *http.Client {
+	c := safehttp.NewClient(10 * time.Second)
+	c.CheckRedirect = func(*http.Request, []*http.Request) error {
 		return http.ErrUseLastResponse
-	},
-}
+	}
+	return c
+}()
 
 // ResolveArchiveToday looks up the newest archive.today / archive.ph snapshot
 // for the given URL. archive.ph has no public availability API, but its