fix(farm): enforce secure API request boundaries

[SUaDtL]

Summary

Closes the SD-02 farm base-URL review and fixes the transport defects it exposed.

• Validates base URLs at both fetch-producing boundaries, including exported programmatic seams.
• Rejects userinfo on every scheme without reflecting configured credentials.
• Refuses automatic redirects for both API POST paths.
• Keeps provider response bodies and secret-bearing endpoint components out of diagnostics.
• Rebuilds the shipped farm.js bundle and records the focused review under .codearbiter/reports/.

Why

The original guard protected CLI configuration, but direct exported calls could bypass it. Default fetch redirect handling could also forward POST bodies to an unvalidated destination. Credential-bearing URLs and provider-controlled bodies could enter logs, retry prompts, or reports.

Tradeoff (Level 2 security boundary): redirects now fail closed instead of being followed, and diagnostics identify only the parsed origin. This preserves the transport and secret-handling guarantees in ADR-0003 and .codearbiter/security-controls.md.

Verification

• npm test: 198 passed
• npm run typecheck: passed
• npm run build: passed; second build produced the same SHA-256
• npm audit --omit=dev --audit-level=critical: 0 vulnerabilities
• Repository script matrix: all 15 commands passed
• Hook suite: 967 passed
• Plugin reference validation: passed
• Final security review: 0 CRITICAL, HIGH, MEDIUM, or LOW findings
• Coverage and call-site reviews: passed

Closes #353

[SUaDtL]

Superseded by #313, the single hackathon review surface. This PR's recorded head and changes are represented in #313's exact 16-PR / 29-commit / 126-path source manifest. PR #313 passed final exact-head CI at commit 6173b1d and remains open and unmerged. Closing this source PR to avoid parallel review; please continue review and discussion on #313.