[Bug] SSRF / Unsafe Outbound Request in Webhook/Scrape Handoffs

File: apps/api/src/index.ts Issue: The application allows local webhook configurations (ALLOW_LOCAL_WEBHOOKS: true in test/self-host setups) and performs outbound scraping/fetching based on user-supplied URLs without complete IP-blacklist validation against internal metadata services or private subnets, posing a Server-Side Request Forgery (SSRF) risk. Solution: Ensure proper validation and sanitization of all user-supplied destination URLs against loopback, link-local, and private RFC 1918 IP ranges before dispatching HTTP requests or webhooks, unless explicitly overridden by a securely authenticated administrative configuration