v0.9.0 - bulk-crawl hardening

• Absolute wall-clock per_url_timeout (slow-drip proof)
• DNS-bounded concurrent SSRF pre-check (bulk groups 90s to 20-36s)
• Cache eviction cap 5000 (WEBGET_CACHE_MAX) + lazy scan
• Strategy memory 14-day TTL + legacy format migration
• Error diagnostics: empty-string exceptions fall back to type name
• reasons: [] always present (consistent shape)
• SSRF route guard handles BrowserContext (profile path)
• MCP login auto-headless on servers without display
• Test suite: 344 passed, 0 failed (was 3 pre-existing failures) - Rouge