fix: fail closed when an SSRF-guarded host cannot be resolved

validate_url() previously returned None (allow) on socket.gaierror, so a
host that failed to resolve at check time was passed straight to yt-dlp. A
host we cannot resolve is a host we cannot verify as non-internal, and it may
resolve differently when yt-dlp fetches it. Reject it instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/url_guard.py

@@ -76,8 +76,10 @@ def validate_url(url: str) -> str | None:
     try:
         addrinfo = socket.getaddrinfo(hostname, parts.port, proto=socket.IPPROTO_TCP)
     except socket.gaierror:
-        # Let yt-dlp surface a normal resolution error rather than masking it.
-        return None
+        # Fail closed: a host we cannot resolve is a host we cannot verify as
+        # non-internal, so refuse it rather than letting the download proceed
+        # to a target that may resolve differently at fetch time.
+        return f'Could not resolve host "{hostname}"'
     except (UnicodeError, ValueError):
         return f'Invalid host "{hostname}"'