42a09c42f8
- annotate.ts: add assertSafeUrl() to reject non-https/data URLs and private/reserved IPs (SSRF prevention); cap response body to 10 MB - jsonParser.ts: truncate raw model output in error log to first 800 chars to avoid flooding logs / leaking sensitive content