Harden outbound webhook delivery destinations and response handling

[nicoloboschi]

Summary

Hardens outbound webhook delivery, where the destination URL (and method,
headers, params) is fully caller-supplied. Two controls:

1. Destination restriction (deny-by-default). The delivery worker refuses to
connect to private, loopback, or link-local addresses — including the cloud
metadata address 169.254.169.254, 127.0.0.1, and RFC-1918/CGNAT/ULA ranges.
All delivery traffic flows through a single guarded httpx transport that:

• resolves the host and rejects any resolved address in a blocked range,
• pins the connection to a validated IP (preserving the Host header and
  TLS SNI) so a DNS name cannot be rebound to an internal address between
  validation and connect, and
• tries each validated address so dual-stack hosts still connect.

Operators re-permit specific internal destinations via
HINDSIGHT_API_WEBHOOK_ALLOWED_HOSTS (hosts or IP/CIDR — e.g. 127.0.0.1 for
local testing). Registration also validates the URL for immediate 400
feedback on obvious cases.

2. Response-body handling. The delivery-history API no longer returns the
raw upstream response body by default — only the status code, which is what
delivery debugging actually needs. Operators can opt in with
HINDSIGHT_API_WEBHOOK_EXPOSE_RESPONSE_BODY.

Both flags are server-level only (not per-bank configurable), so a tenant
cannot re-open the ranges or re-enable body exposure for itself.

Behavior change (breaking)

Webhooks pointed at loopback/private hosts now fail unless the host is added to
HINDSIGHT_API_WEBHOOK_ALLOWED_HOSTS. This is intentional.

Tests

• tests/test_webhook_url_guard.py — range classification, URL validation,
  resolve-and-pin, guarded-transport pinning against a real loopback server
  (incl. dual-stack fallback and Host-preservation), and API-layer body
  gating (default-hidden / opt-in) + a guard that the flags stay non-configurable.
• tests/test_webhooks.py — HTTP integration: registration rejection (400)
  for internal/invalid URLs, and the delivery-history endpoint hiding the body
  by default / exposing it when opted in.

Notes

• No request/response schema fields or endpoints changed → OpenAPI spec and
  generated clients are unaffected.
• Docs + .env.example (and the bundled embed copy) updated.