Add 3 tests for cleanupOrphanedFights: verifies db.update sets status='cancelled' with endedAt on stale live fights, returns 0 on success, and propagates DB errors correctly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix gaps in isAllowedWebhookUrl: IPv6 bracket stripping for [::1], [fe80::], [::ffff:7f00:1]; block 0.0.0.0 and [::] (IPv6 all-zeros); handle URL-parser normalized ::ffff:7fxx IPv6-mapped localhost. Add 20 SSRF test cases covering: file://, gopher://, data: schemes, localhost, 127.0.0.1, 10.x, 172.16-31.x, 192.168.x, IPv6 ::1, fe80::, fc00::/fd00::, octal/decimal IP bypass, metadata IP 169.254.169.254, .localhost TLD, overly long URLs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>