security: harden first preview boundaries

Sanitized snapshot of private source 13a965dd6ea705dd92499f7dbeaa00c25c15247d. Require same-origin evidence for unsafe methods, fail closed on invalid authentication middleware configuration, and bound untrusted request metadata.

AI-Assistance: OpenAI Codex assisted implementation, testing, and security review.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

requestmeta/requestmeta.go

@@ -191,7 +191,7 @@ func parseForwardedFor(value string) ([]netip.Addr, error) {
 	result := make([]netip.Addr, 0, len(parts))
 	for _, part := range parts {
 		address, err := netip.ParseAddr(strings.TrimSpace(part))
-		if err != nil {
+		if err != nil || address.Zone() != "" {
 			return nil, ErrInvalidForwarding
 		}
 		result = append(result, address.Unmap())