Block SSRF on ExternalProvider fetches

[jzongker]

Anonymous ExternalProvider routes were doing axios.get(ep.apiUrl) and a second hop to venue.apiUrl from that JSON, with no scheme/host checks, no private-IP block, and default redirect following.

What changed

• All server-side provider fetches go through fetchProviderJson.
• HTTPS only; credentials, IP literals, localhost, and metadata-style hosts are rejected.
• DNS is resolved before the request; private, link-local, loopback, CGNAT, and multicast answers are rejected.
• Redirects are disabled (maxRedirects: 0).
• The venue hop must be the same host as the stored provider URL, or a *.lessons.church host.

Why this shape
LessonsApp portal/player callers use /externalProviders/:id/lessons, /playlist/..., and venue plan/action routes. First-party trees and venue feeds live on api.lessons.church (and staging). Churches can also add Open Lesson Format feeds on their own hosts, so the first hop allows any public HTTPS DNS name after the IP checks. A hostile provider document cannot send the Lambda to an internal URL or to a different public host.

Public playlist/player routes stay anonymous; they only fetch URLs that pass the same checks.

Not in this PR
FreeShow and SignPresenter are untouched.

Do not merge until reviewed.