Link cards were never showing real previews. Every unfurl silently fell back
to a bare hostname (no title, description, or image). Cause: /api/unfurl passed
the SSRF publicOnlyDispatcher — an undici@8Agent — into open-graph-scraper,
which bundles undici@7; the cross-version dispatcher failed undici's handler
validation (invalid onRequestStart method / UND_ERR_INVALID_ARG) and threw on
every request. The route now fetches the HTML itself through safeFetch (which
applies the same connect-time private-IP guard on our own undici) and hands the
markup to ogs via its html option, so no cross-copy dispatcher is involved.
Non-HTML responses (images, PDFs, error pages) and HTTP errors now short-circuit
to the graceful hostname fallback instead of feeding junk to the parser.
Pages with no OG/Twitter tags fall back to the <title> tag before the hostname.
Dropped bogus media URLs (e.g. a bare data:, favicon) — favicon/image are kept
only when they're real http(s) URLs, else the Google favicon fallback is used.
LinkCard now collapses the OG image when the remote host blocks hotlinking or
404s it (onError + referrerPolicy="no-referrer") instead of leaving a broken
image box; the favicon falls back to an accent dot the same way.
