Harden subscription fetching, API limits, and production deployment

[ssharkkky]

What changed

• harden subscription fetching against IPv4-mapped/private addresses, redirect bypasses, DNS rebinding, proxy inheritance, and oversized upstream responses
• bound merge requests to 8 subscription URLs, 2 MiB request bodies, 1 MiB raw input, and 5000 total nodes
• validate request field types, profiles, and limits while preserving security HTTP errors
• add a fully pinned Python 3.12 dependency lock, GitHub Actions tests, deployment documentation, a hardened systemd unit, and an atomic commit-SHA release script with health-check rollback

Why

The public API previously had exploitable SSRF paths, unbounded request fan-out, and a production deployment that depended on a dirty worktree and global Python packages. These changes close the network boundary and make releases testable and reproducible.

Validation

• python -m pip check
• python -m unittest discover -s tests -v — 23/23 passed locally and in a clean production venv
• bash -n deploy/deploy-release.sh
• git diff --check
• GitHub Actions unit-tests passed on head 33d60a4
• production immutable release 33d60a44db7a8b2d99c66866606e952fa0ca4901 is active
• production home/templates/raw merge return 200
• loopback SSRF and invalid limits return 400
• Nginx enforces 2 MiB bodies, 30 requests/minute, burst 20, and 8 concurrent connections; 413/429 paths verified