fix(web): bound the fetch SSRF pre-flight DNS lookup

[asto18089]

Summary

The SSRF pre-flight in validate_fetch_target resolved the target host with an unbounded tokio::net::lookup_host. The lookup runs before the guarded request — and once per redirect — so a wedged resolver stalled the fetch tool past its own 60s HARD_MAX_TIMEOUT envelope with no recovery.

Bound the pre-flight at 10s (DNS_PREFLIGHT_TIMEOUT). A hung resolver now fails the pre-flight with an explicit "timed out resolving host" permission error; the DNS-failure error path and message are unchanged, and the existing resolution-failure regression still holds. Literal-IP and localhost targets don't resolve and are unaffected. A test pins the bound below the fetch hard cap so the two constants cannot drift.

Testing

• cargo test -p codewhale-tui --lib web::guard
• cargo clippy -p codewhale-tui --all-targets --all-features --locked

Disclosure: the timeout branch itself is not exercised by a test (that would require intercepting OS DNS); coverage is the constant-relationship pin plus the preserved, still-tested resolution-failure path.

Adapted from the Pinvou fork's timeout audit (Pinvou/CodeWhale d349f2537, the DNS pre-flight slice only).

Checklist

• Updated docs or comments as needed
• Added or updated tests where relevant
• No CHANGELOG.md changes