feat: add URL-based image import (single + bulk)

Add a fourth image ingestion path: importing images by URL.

Backend:
- POST /api/v1/fetch-urls endpoint with SSRF protection, image validation,
  preview generation, and p-queue concurrency
- SSRF utility blocking private IPs, validating redirect hops, with
  comprehensive IPv4/IPv6 range coverage

Frontend:
- Always-visible URL input in the dropzone for quick single-image import
- Bulk URL import modal with smart URL parsing (lists, markdown, HTML),
  per-URL progress tracking, retry on failure, and batch add
- useUrlImport hook managing the full fetch lifecycle

Tests: 48 new tests (23 SSRF unit, 10 URL parser unit, 15 integration)

apps/web/src/lib/url-parser.ts

@@ -0,0 +1,42 @@
+function isValidHttpUrl(str: string): boolean {
+  try {
+    const url = new URL(str);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+export function extractUrls(input: string): string[] {
+  const urls: string[] = [];
+
+  for (const rawLine of input.split("\n")) {
+    let line = rawLine.trim();
+    if (!line) continue;
+
+    // Strip numbered list prefixes: "1. ", "2) ", "3 "
+    line = line.replace(/^\d+[.)]?\s+/, "");
+    // Strip bullet prefixes: "- ", "* ", "+ "
+    line = line.replace(/^[-*+]\s+/, "");
+
+    // Extract from markdown links: [text](url)
+    const mdMatch = line.match(/\[.*?]\((https?:\/\/[^)]+)\)/);
+    if (mdMatch) {
+      urls.push(mdMatch[1]);
+      continue;
+    }
+
+    // Extract from HTML img tags: <img src="url">
+    const imgMatch = line.match(/<img[^>]+src=["'](https?:\/\/[^"']+)["']/i);
+    if (imgMatch) {
+      urls.push(imgMatch[1]);
+      continue;
+    }
+
+    if (isValidHttpUrl(line)) {
+      urls.push(line);
+    }
+  }
+
+  return [...new Set(urls)];
+}