[Bug]: favicon requests send private link hosts to Google

[fe-franco]

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/web

Steps to reproduce

1. Open a preview tab pointing at http://localhost:5173.
2. Post a markdown link to http://192.168.1.10:8080 in a thread.
3. Watch the outbound requests from web and from mobile.

Expected behavior

The app sends no private host name to a third party. It renders the fallback that each call site already has: a glyph on mobile, a GlobeIcon in web chat, and null from the preview helper.

Actual behavior

The app requests https://www.google.com/s2/favicons?domain=localhost%3A5173&sz=32 and https://www.google.com/s2/favicons?domain=192.168.1.10&sz=32

Three call sites build the URL from a link host:

apps/mobile/src/features/threads/ThreadFeed.tsx:284   MarkdownExternalLink
apps/web/src/components/ChatMarkdown.tsx:858          MarkdownLinkFavicon
apps/web/src/lib/favicon.ts:10                        faviconUrlForOrigin

The preview helper guards the protocol but never the host:

if (url.protocol !== "http:" && url.protocol !== "https:") return null;
return `${FAVICON_PROVIDER}?domain=${encodeURIComponent(url.host)}&sz=${size}`;

resolveMarkdownLinkPresentation marks every http: and https: link as external, so the host can be private:

// apps/mobile/modules/t3-markdown-text/src/markdownLinks.ts:356
if (parsed.protocol === "http:" || parsed.protocol === "https:") {
  return { kind: "external", href: parsed.toString(), host: parsed.hostname };
}

The preview tab strip matters most. Its doc comment describes it as a preview helper, and a preview URL usually points at a dev server or a tailnet host. So it leaks on the normal path, not the rare one. Google cannot resolve a private host, so every one of these requests also fails.

Impact

Major degradation or frequent failure

Version or commit

main @ 1a003e3

Environment

apps/web and apps/mobile. Local development servers and Tailscale hosts appear in threads and previews often. Issue #5818 shows that users pair over 100.64.0.0/10. I did not confirm whether apps/desktop inherits the web path.

Logs or stack traces

GET https://www.google.com/s2/favicons?domain=localhost%3A5173&sz=32
GET https://www.google.com/s2/favicons?domain=192.168.1.10&sz=32
-> image load error, host added to failedFaviconHosts

Screenshots, recordings, or supporting files

No response

Workaround

Post no links to private hosts, and open no previews on them. Neither avoidance is practical during development.