fix(security): Phase 1 P0 hardening from cross-project audit

Close open uploads, image-proxy SSRF, fail-open AI quotas in production,
auth gaps on app routes, and MCP tenant isolation issues.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/lib/ssrf-guard.ts

@@ -0,0 +1,22 @@
+/** Block hosts that must not be fetched by server-side proxies. */
+export function isBlockedFetchHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, '')
+
+  if (!host || host === 'localhost' || host.endsWith('.localhost')) return true
+  if (host === '0.0.0.0' || host === '::' || host === '::1') return true
+  if (host.endsWith('.local') || host.endsWith('.internal')) return true
+
+  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host)
+  if (ipv4) {
+    const octets = ipv4.slice(1, 5).map(Number)
+    if (octets.some((n) => n > 255)) return true
+    const [a, b] = octets
+    if (a === 10 || a === 127 || a === 0) return true
+    if (a === 169 && b === 254) return true
+    if (a === 172 && b >= 16 && b <= 31) return true
+    if (a === 192 && b === 168) return true
+    if (a === 100 && b >= 64 && b <= 127) return true
+  }
+
+  return false
+}