fix(sub): treat external subscription providers as untrusted input

A client's external subscription is fetched from a third party on every
subscriber refresh, and the fetcher trusted it more than its siblings:
- it dialled any address, redirects included; it now goes through the
  SSRF guard like the outbound subscription and remote routing fetchers;
- it forwarded any line containing "://"; it now keeps only server share
  links, so app deeplinks and plain URLs never reach the subscriber's app;
- it bounded the body but not the link count (now 1000) or the headers
  (now 64 KiB), and stored the raw error, URL included, on every row; the
  stored error is now host-only and at most 1 KiB.

The link parser also refuses links that nest JSON past 16 levels, since
the JSON subscription pretty-prints it at quadratic cost, and external
configs are marshalled compactly until the final, single indent pass.

internal/util/common/format.go

@@ -1,6 +1,9 @@
 package common
 
-import "strconv"
+import (
+	"strconv"
+	"unicode/utf8"
+)
 
 // FormatTraffic formats traffic bytes into human-readable units (B, KB, MB, GB, TB, PB).
 func FormatTraffic(trafficBytes int64) string {
@@ -14,3 +17,19 @@ func FormatTraffic(trafficBytes int64) string {
 	}
 	return strconv.FormatFloat(size, 'f', 2, 64) + units[unitIndex]
 }
+
+// maxStatusTextBytes bounds an error text a third party shapes before it is stored as a
+// row's status; legitimate messages are a line or two.
+const maxStatusTextBytes = 1024
+
+// TruncateStatusText cuts s to maxStatusTextBytes on a UTF-8 boundary.
+func TruncateStatusText(s string) string {
+	if len(s) <= maxStatusTextBytes {
+		return s
+	}
+	cut := maxStatusTextBytes
+	for cut > 0 && !utf8.RuneStart(s[cut]) {
+		cut--
+	}
+	return s[:cut] + "... (truncated)"
+}