fix(#279): Validate orchestrator URL configuration (SSRF risk)

Implemented comprehensive URL validation to prevent SSRF attacks:
- Created URL validator utility with protocol whitelist (http/https only)
- Blocked access to private IP ranges (10.x, 192.168.x, 172.16-31.x)
- Blocked loopback addresses (127.x, localhost, 0.0.0.0)
- Blocked link-local addresses (169.254.x)
- Blocked IPv6 localhost (::1, ::)
- Allow localhost in development/test environments only
- Added structured audit logging for invalid URL attempts
- Comprehensive test coverage (37 tests for URL validator)

Security Impact:
- Prevents attackers from redirecting agent spawn requests to internal services
- Blocks data exfiltration via malicious orchestrator URL
- All agent operations now validated against SSRF

Files changed:
- apps/api/src/federation/utils/url-validator.ts (new)
- apps/api/src/federation/utils/url-validator.spec.ts (new)
- apps/api/src/federation/federation-agent.service.ts (validation integration)
- apps/api/src/federation/federation-agent.service.spec.ts (test updates)
- apps/api/src/federation/audit.service.ts (audit logging)
- apps/api/src/federation/federation.module.ts (service exports)

Fixes #279

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/api/src/federation/federation.module.ts

@@ -17,6 +17,8 @@ import { FederationAuditService } from "./audit.service";
 import { SignatureService } from "./signature.service";
 import { ConnectionService } from "./connection.service";
 import { OIDCService } from "./oidc.service";
+import { CommandService } from "./command.service";
+import { FederationAgentService } from "./federation-agent.service";
 import { PrismaModule } from "../prisma/prisma.module";
 
 @Module({
@@ -56,7 +58,18 @@ import { PrismaModule } from "../prisma/prisma.module";
     SignatureService,
     ConnectionService,
     OIDCService,
+    CommandService,
+    FederationAgentService,
+  ],
+  exports: [
+    FederationService,
+    CryptoService,
+    FederationAuditService,
+    SignatureService,
+    ConnectionService,
+    OIDCService,
+    CommandService,
+    FederationAgentService,
   ],
-  exports: [FederationService, CryptoService, SignatureService, ConnectionService, OIDCService],
 })
 export class FederationModule {}