#43 FTX-43: SSRF guard rewrite + secret hygiene

net_guard resolve-validate-pin (closes DNS rebinding TOCTOU); WEBHOOK_ALLOW_HOSTS env replaces hardcoded webhook.site bypass; .env -> .env.example with placeholders; rotation runbook for all live secrets (rotated at deployment). UB-SEC-3, UB-WH-4, AC-10. Phase 1.