fix(site-import): BLOCKED_NETS 补 v6 未指定/组播/保留段与 NAT64

- ::/128（v6 版 0.0.0.0，此前两层防线均放行）+ 224.0.0.0/4（组播）
  + 240.0.0.0/4（保留/广播，含 255.255.255.255）+ 64:ff9b::/96（NAT64）
  + 198.18.0.0/15（基准段）
- 测试 +9：六段参数化钉位、http://[::]/x URL 层拒绝、重定向协议切换
  （302→ftp://）第二跳拦截、DNS rebinding 端到端（真实 client 仅打桩
  getaddrinfo 返 10.x，证明连接层校验先于连接发生）

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/platform/site_import/safe_fetch.py

@@ -28,8 +28,10 @@ from httpcore._exceptions import ConnectError, ConnectTimeout, map_exceptions
 
 BLOCKED_NETS = [ipaddress.ip_network(n) for n in [
     "127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
-    "169.254.0.0/16", "0.0.0.0/8", "100.64.0.0/10", "::1/128",
-    "fc00::/7", "fe80::/10", "::ffff:0:0/96",
+    "169.254.0.0/16", "0.0.0.0/8", "100.64.0.0/10",
+    "224.0.0.0/4", "240.0.0.0/4", "198.18.0.0/15",
+    "::1/128", "fc00::/7", "fe80::/10", "::ffff:0:0/96",
+    "::/128", "64:ff9b::/96",
 ]]
 ALLOWED_PORTS = {80, 443}
 MAX_REDIRECTS = 5