fix(#279): Validate orchestrator URL configuration (SSRF risk)

Implemented comprehensive URL validation to prevent SSRF attacks:
- Created URL validator utility with protocol whitelist (http/https only)
- Blocked access to private IP ranges (10.x, 192.168.x, 172.16-31.x)
- Blocked loopback addresses (127.x, localhost, 0.0.0.0)
- Blocked link-local addresses (169.254.x)
- Blocked IPv6 localhost (::1, ::)
- Allow localhost in development/test environments only
- Added structured audit logging for invalid URL attempts
- Comprehensive test coverage (37 tests for URL validator)

Security Impact:
- Prevents attackers from redirecting agent spawn requests to internal services
- Blocks data exfiltration via malicious orchestrator URL
- All agent operations now validated against SSRF

Files changed:
- apps/api/src/federation/utils/url-validator.ts (new)
- apps/api/src/federation/utils/url-validator.spec.ts (new)
- apps/api/src/federation/federation-agent.service.ts (validation integration)
- apps/api/src/federation/federation-agent.service.spec.ts (test updates)
- apps/api/src/federation/audit.service.ts (audit logging)
- apps/api/src/federation/federation.module.ts (service exports)

Fixes #279

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

apps/api/src/federation/audit.service.ts

@@ -207,4 +207,18 @@ export class FederationAuditService {
       securityEvent: true,
     });
   }
+
+  /**
+   * Log invalid orchestrator URL configuration attempt
+   * Logged when orchestrator URL validation fails (SSRF prevention)
+   */
+  logInvalidOrchestratorUrl(url: string, error: string): void {
+    this.logger.warn({
+      event: "FEDERATION_INVALID_ORCHESTRATOR_URL",
+      url,
+      error,
+      timestamp: new Date().toISOString(),
+      securityEvent: true,
+    });
+  }
 }