fix(paroche): close IPv4-compatible-IPv6 SSRF bypass and resolve magnet trackers

[forkwright]

Closes three SSRF gaps in the download-URL guard (crates/paroche/src/net_validate.rs):

• IPv4-compatible IPv6 (::/96) bypass — ip_is_disallowed only judged the IPv4-mapped form (::ffff:a.b.c.d); the deprecated compatible form (::127.0.0.1) skipped every v4 range check and reached loopback. Now the v6 arm checks mapped → v6-native ranges → ::/96 embedded-v4 (in that order, so ::/::1 stay v6-judged).
• Magnet tracker domains now resolved — a tracker announce is a live server-side request, so a tracker domain resolving to internal space is a blind-SSRF primitive. Tracker domains are now DNS-resolved and rejected if internal; unresolvable trackers pass (auxiliary/third-party — a dead tracker must not reject an otherwise-valid magnet).
• Latent http-fetch rebinding documented — there is no server-side HTTP fetcher for download_url today (P2P), so the enqueue-vs-fetch TOCTOU is latent; a WARNING records that any future HTTP fetcher must pin the validated IP.

Gate: kanon gate --full green (clippy -D warnings, nextest 1729, deny, lint). New tests cover the ::/96 forms and the unresolvable-tracker case.

Closes #479