fix(webhooks): block private IPv4-mapped hosts

[aiirvizionz]

Summary

• Block private IPv4 ranges when they are supplied as IPv4-mapped IPv6 webhook hosts
• Parse both dotted and Node-normalized hexadecimal mapped forms, e.g. ::ffff:a9fe:a9fe
• Add regression coverage for link-local and RFC1918 mapped hosts while keeping public mapped addresses allowed

Why

The webhook destination validator blocked private IPv4 literals and common IPv6 local ranges, but Node normalizes inputs like http://[::ffff:169.254.169.254]/hook to ::ffff:a9fe:a9fe. That bypassed the existing mapped-host string checks and could allow SSRF-style webhook destinations to private infrastructure.

Validation

• Direct Node behavior check imported validateWebhookUrl and verified mapped 169.254, 172.16, 10, and 192.168 hosts are blocked while a public mapped address is allowed.
• git diff --check

Note: pnpm exec vitest run tests/webhook-url-validation.test.js attempted a Windows postinstall and failed on the repo's POSIX command -v ... || true hook. Running the local Vitest shim then hit a Vite/plugin-react export mismatch under Node 24 before test collection, so I validated the pure URL helper directly with Node and left the Vitest regression in the PR for CI.