fix(security): Phase 4 edge hardening + SSRF egress guard

Backend security fixes from the Phase 1 register / Phase 2 roadmap (PR1 + V-01):

- V-01 SSRF: new SafeHttpGuard validates outbound unsubscribe URLs (scheme allowlist
  + DNS-resolve-and-block private/loopback/link-local/ULA/metadata ranges), wired into
  UnsubscribeService; the "unsubscribe" HttpClient now disables auto-redirect so a
  validated external URL can't 3xx into an internal target. +33 unit tests.
- V-04: session cookie SecurePolicy=Always in non-dev (SameAsRequest in dev).
- V-06: UseExceptionHandler/ProblemDetails in prod; Cleanup/Unsubscribe no longer
  echo ex.Message to clients (logged server-side, generic message returned).
- V-08: ForwardedHeaders trusted only from configurable KnownNetworks (default private
  ranges) + ForwardLimit, instead of trusting any client. New ForwardedHeaders config.
- V-09: returnUrl validated with Url.IsLocalUrl (no open redirect via OAuth flow).
- V-10: SearchService clamps Page/PageSize (<=200); Analytics clamps take/days.
- V-11: baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy,
  COOP) + HSTS in prod.
- V-13: /app/info discloses only devMode to anonymous callers unless dev mode is on.
- V-12: API container runs as non-root 'app' user (keys dir pre-owned).
- V-03: Postgres + API ports bound to 127.0.0.1; POSTGRES_PASSWORD now required (no
  weak default fallback).

API compatibility preserved (clamps not rejections; error-body shape changes only on
failure paths). No DB migrations. Build + all 33 unit tests green. V-15 (MailKit
NU1902) persists across versions and the SMTP path is default-off — tracked, not bumped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/InboxIntel.Api/Controllers/AnalyticsController.cs

@@ -16,11 +16,13 @@ public class AnalyticsController : ApiControllerBase
 
     [HttpGet("top-senders")]
     public async Task<IActionResult> TopSenders([FromQuery] int take = 20, CancellationToken ct = default)
-        => Ok(await _analytics.GetTopSendersAsync(UserId, take, ct));
+        // V-10: clamp to a sane bound (the SPA legitimately requests up to 5000 to list
+        // all senders) so a caller cannot force an unbounded scan.
+        => Ok(await _analytics.GetTopSendersAsync(UserId, Math.Clamp(take, 1, 5000), ct));
 
     [HttpGet("volume")]
     public async Task<IActionResult> Volume([FromQuery] int days = 90, CancellationToken ct = default)
-        => Ok(await _analytics.GetVolumeOverTimeAsync(UserId, days, ct));
+        => Ok(await _analytics.GetVolumeOverTimeAsync(UserId, Math.Clamp(days, 1, 3660), ct));
 
     [HttpGet("heatmap")]
     public async Task<IActionResult> Heatmap(CancellationToken ct) => Ok(await _analytics.GetHeatmapAsync(UserId, ct));

src/InboxIntel.Api/Controllers/AppInfoController.cs

@@ -28,10 +28,17 @@ public class AppInfoController : ControllerBase
     public IActionResult Info()
     {
         var devMode = _config.GetValue<bool?>("App:DevMode") ?? _env.IsDevelopment();
+        // V-13: when NOT in dev mode, disclose nothing beyond the flag to anonymous
+        // callers. The dev banner (the only consumer of environment/maxMessages) only
+        // renders when devMode is true, so this preserves the feature without leaking
+        // the environment name or sync cap in production.
+        if (!devMode)
+            return Ok(new { devMode = false });
+
         return Ok(new
         {
+            devMode = true,
             environment = _env.EnvironmentName,
-            devMode,
             maxMessages = _config.GetValue<int>("GmailSync:MaxMessages")
         });
     }

src/InboxIntel.Api/Controllers/AuthController.cs

@@ -17,7 +17,12 @@ public class AuthController : ControllerBase
     [HttpGet("login")]
     [AllowAnonymous]
     public IActionResult Login([FromQuery] string? returnUrl = "/")
-        => Challenge(new AuthenticationProperties { RedirectUri = returnUrl }, GoogleDefaults.AuthenticationScheme);
+    {
+        // V-09: only allow local post-login redirects; reject absolute/off-host targets
+        // so the OAuth flow can't be abused as an open redirect for phishing.
+        var safe = !string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl) ? returnUrl : "/app";
+        return Challenge(new AuthenticationProperties { RedirectUri = safe }, GoogleDefaults.AuthenticationScheme);
+    }
 
     [HttpPost("logout")]
     [Authorize]