Read the whole head, and fix isPrivateIp while we are in there

[sivert-io]

Link previews came back empty for a lot of sites, and the card the client drew
for an empty preview was the "weird card" in the screenshot that started this.
Two changes here: one bug that is not about previews at all, and the preview
work itself.

Look at this first

isPrivateIp answered false for 172.16/12, 192.168/16 and 169.254/16.
num & r.mask gives a signed 32-bit result and those prefixes are unsigned
literals, so the comparison could never be true for them. Only 10/8 and 127/8
ever worked.

Two things follow from that, and neither is about link previews:

• lan_open gates on it in socket/handlers/join.ts, so a client on a 192.168
  address was never seen as being on the LAN. That is the range nearly every
  home router hands out, so the feature was off for most of the people it is
  for. I have not tested that path end to end — worth a look.
• 169.254/16 is where the cloud metadata service answers.

Fix is >>> 0 on the masked value, in its own commit, with tests over all five
ranges and the addresses either side of each boundary. If you would rather this
went in on its own, say so and I will split it out.

The previews

The read stopped at 50 KB. Measured 2026-09-03: MDN closes its head at 5.9 KB
and Steam at 8.3 KB, but Modrinth's og:title sits at byte 246,740 and
YouTube's at 699,799. Both returned nothing at all. The read now stops at
</head> or 1 MB, so GitHub still stops at 32 KB and MDN at 8 KB, and the two
that were broken come back complete.

Parsing moves to utils/pageMetadata.ts and picks up og:image:width/height
(which lets it skip the request that used to measure the image), og:type,
theme-color, image alt, author, published time, and any oEmbed endpoint the
page advertises. theme-color is the one that pays off for sites nobody has
written a special case for: Modrinth's green, Steam's near-black, GitHub's
slate.

A non-2xx page now returns its status and nothing else. GitHub 404s a private
repository to anyone not signed in and its 404 page carries GitHub's own
metadata, so parsing it produced a card titled "Build software better,
together" for a link to somebody's repo.

oEmbed finds endpoints by reading them off the page rather than only knowing
four hosts, so Flickr, CodePen, Giphy, WordPress and Mastodon work without
being listed. Reddit and Bluesky are added by name since both want particular
parameters.

What changes about outbound requests

This is the part I am least sure about and the reason the diff is bigger than
the feature.

Redirects are now followed one hop at a time with the check applied to each,
because redirect: "follow" hands the whole chain to undici and the third hop
is as attacker-chosen as the first. The oEmbed endpoint discovered from a page
goes through the same check for the same reason. checkPreviewUrl also
resolves the hostname, so a public name with an A record pointing at
169.254.169.254 is refused rather than fetched.

Still open, and not closed here: DNS is resolved to check and resolved again to
connect, so a name that answers differently the second time gets through.
Closing it means connecting to the address rather than the name, which needs a
custom agent.

The 1 MB cap is a real bandwidth increase for a page like YouTube's. It is
server-side, cached for an hour, and only for links people actually post, but
it is a number worth disagreeing with if you want to.

Checks

yarn test: 659 pass. The 27 failures are all Windows EPERM on temp-directory
cleanup in after hooks — every assertion in those files passes, and they fail
the same way on main. tsc --noEmit clean.

Client and mobile read the new fields:

• Give a link card the shape the page actually earns client#369
• Draw what a message links to, on the phone too mobile#182