api/ping: allowlist hosts and block redirects to close SSRF/LAN-scan vector

opencode.md

@@ -83,7 +83,7 @@ src/app/
   api/
     heatmap/route.ts    → proxy for git.dvorakmortonxd.dev contribution heatmap
     activities/route.ts → proxy for the user's GitDXD activity feed
-    ping/route.ts       → service health check (HTTP + minecraft:// via mcstatus.io)
+    ping/route.ts       → service health check (HTTP + minecraft:// via mcstatus.io); host allowlist
   components/
     ThemeRoot.tsx       → picks which shell to show (the router of the UI)
     TerminalLayout.tsx  → "terminal" theme (Gruvbox)
@@ -261,6 +261,12 @@ list reordering, not free placement. Don't confuse the two.
 - The SMP service shortcut opens `SMP_APP` (in `apps.tsx`, registered in
   `APP_BY_ID` only, like `ALACRITTY_APP`) — a Minecraft-style join menu that
   reads live data from `/api/ping?url=minecraft://…`.
+- `/api/ping` is a **host-allowlisted** SSRF guard (public + unauthenticated):
+  it only contacts `*.dvorakmortonxd.dev` plus the friends' domains, rejects
+  other hosts/schemes, validates the `minecraft://` address, and never follows
+  redirects. **Adding a service or friend host means adding it to
+  `ALLOWED_HOSTS` in `api/ping/route.ts`**, otherwise its status dot reads
+  "Dead". Do not turn this route back into an open fetch proxy.
 - Service shortcuts show the real site in an iframe via
   `createWebsiteApp({ embed: true })` (the shortcut's `embed` flag). It only
   works for sites that don't send `X-Frame-Options` / a `frame-ancestors` CSP.