security: fix 10 vulnerabilities from security audit

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/fabledassistant/routes/settings.py

@@ -3,7 +3,7 @@ from quart import Blueprint, jsonify, request
 from fabledassistant.auth import login_required, get_current_user_id
 from fabledassistant.config import Config
 from fabledassistant.services.caldav import CALDAV_SETTING_KEYS, get_caldav_config, test_connection
-from fabledassistant.services.llm import get_installed_models
+from fabledassistant.services.llm import get_installed_models, _is_private_url
 from fabledassistant.services.settings import delete_setting, get_all_settings, set_settings_batch
 
 settings_bp = Blueprint("settings", __name__, url_prefix="/api/settings")
@@ -77,6 +77,16 @@ async def update_caldav():
     uid = get_current_user_id()
     data = await request.get_json()
 
+    # Validate CalDAV URL before saving — block internal/private addresses
+    if "caldav_url" in data:
+        url = str(data.get("caldav_url") or "").strip()
+        if url:
+            parsed_scheme = url.split("://")[0].lower() if "://" in url else ""
+            if parsed_scheme not in ("http", "https"):
+                return jsonify({"error": "CalDAV URL must use http or https"}), 400
+            if _is_private_url(url):
+                return jsonify({"error": "CalDAV URL must not point to an internal or private address"}), 400
+
     settings_to_save = {}
     for key in CALDAV_SETTING_KEYS:
         if key in data: