The SSRF check that passed every test and still had a fail-open branch

A URL-rendering service fixed its SSRF guard so DNS lookup failures now fail closed instead of allowing requests.

The Playwright browser now sends pages, subresources, and redirects through the same request guard.

Tests were added to force resolver errors, and the production helper was separated from the test fixture.

Deployment checks confirmed the updated container and service endpoints were healthy and returning HTTP 200.