The fetchAndConvert() function in src/core/url-fetcher.ts calls fetch() with no:
- Timeout — a slow server can hang the process forever
- Redirect limit — could follow infinite redirects
- Max body size — a 10GB HTML page would be downloaded entirely into memory
- robots.txt respect — should check before fetching
Should add AbortSignal.timeout(30_000), validate content-length header, and cap the body read.