A03: Validate scheme/host/port before every network I/O

- _validate_url_before_io: check scheme (HTTPS only), port (80/443), host
- fetch_html: recursive redirect validation with hop limit (MAX_REDIRECT_HOPS=5)
- Reject non-HTTPS redirects and non-standard ports
- All validation happens BEFORE urlopen() call
- Updated tests for new validation messages
- 109 Python tests pass

tests/test_community_cli.py

@@ -43,20 +43,23 @@ def test_validate_url_host_rejects_disallowed_hosts() -> None:
 
     # Disallowed hosts raise ValueError before network I/O
     with pytest.raises(ValueError, match="not in allowlist"):
-        _validate_url_host("http://localhost:8080/admin")
+        _validate_url_host("https://169.254.169.254/latest/meta-data/")
     with pytest.raises(ValueError, match="not in allowlist"):
-        _validate_url_host("http://169.254.169.254/latest/meta-data/")
-    with pytest.raises(ValueError, match="not in allowlist"):
-        _validate_url_host("http://internal-service.corp/api")
+        _validate_url_host("https://internal-service.corp/api")
+    # Port validation also works
+    with pytest.raises(ValueError, match="not in allowed ports"):
+        _validate_url_host("https://download.rf4db.com:9999/admin")
 
 
 def test_validate_url_host_rejects_missing_hostname() -> None:
     from rf4_research.community_cli import _validate_url_host
 
     with pytest.raises(ValueError, match="valid hostname"):
-        _validate_url_host("not-a-valid-url")
-    with pytest.raises(ValueError, match="valid hostname"):
-        _validate_url_host("")
+        _validate_url_host("https://")
+    with pytest.raises(ValueError, match="scheme.*not allowed"):
+        _validate_url_host("ftp://rf4db.com/file")
+    with pytest.raises(ValueError, match="HTTPS"):
+        _validate_url_host("http://rf4db.com/file")
 
 
 def test_write_state_is_atomic_with_flush(tmp_path: Path) -> None: