Fetch an IPv6 source host written without a port (closes #295)

The fetcher took the host from the source URL and stripped a port with
net.SplitHostPort, which fails when there is no port, so a bracketed
IPv6 host such as [2001:db8::a] kept its brackets, its name lookup
failed, and the request answered 500. validateURL now takes the host
with url.URL.Hostname(), which drops the brackets and any port, so such
a host is fetched like one with a port, through /v1/image/ and through
an encrypted URL, and a private IPv6 address is still refused.

Model: opus-5-5

TODO.md

@@ -30,6 +30,12 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-16 a source host that is an IPv6 address in brackets with no port,
+  such as `[2001:db8::a]`, is fetched like one with a port, through `/v1/image/`
+  and through an encrypted URL (closes #295). The fetcher's check of the source
+  URL kept the brackets when no port followed them, could not look the host up,
+  and the request answered 500. It now checks the address without brackets, so a
+  private one is refused with 403, as with a port.
 - 2026-10-16 a `state_dir` whose name holds `%`, `?` or `#` keeps its database
   at `state.sqlite3` in that directory (closes #290): the `db_url` derived from
   it put the name into a `file:` URL as it was, so SQLite read `%41` as `A`, a