f1d012000e
- Add SSRF defense: reject avatar URLs not starting with https:// - Add per-fetch timeout (5s) instead of relying on http.DefaultClient - Document WebInviteWalletHero handler as unauthenticated by design