fix: stabilize fetch-urls tests for CI and extend format-matrix timeout

Replace mock HTTP server + vi.mock approach with vi.stubGlobal('fetch')
using a public IP (1.2.3.4) that passes real SSRF validation. This
eliminates both the fragile vi.mock (broken under V8 coverage) and the
localhost network dependency (unreliable in CI).

Revert the SSRF_ALLOW_PRIVATE env var that broke ssrf unit tests.

Extend timeout for exotic format error resilience tests to 120s to
accommodate slow JXL + Image enhancement combination in CI.

vitest.config.ts

@@ -60,7 +60,6 @@ export default defineConfig({
       CONCURRENT_JOBS: "3",
       FILE_MAX_AGE_HOURS: "1",
       CLEANUP_INTERVAL_MINUTES: "60",
-      SSRF_ALLOW_PRIVATE: "1",
     },
     coverage: {
       provider: "v8",