Keep the SSRF-safe transport in clientForConfig (closes #69)

internal/delivery/engine.go

@@ -1713,10 +1713,15 @@ func (e *Engine) clientForConfig(
 	cfg *HTTPTargetConfig,
 ) *http.Client {
 	if cfg.Timeout > 0 {
+		// Reuse the shared client's SSRF-safe transport so
+		// a per-target timeout does not drop the
+		// request-time private-IP guard. Only the timeout
+		// is overridden.
 		return &http.Client{
 			Timeout: time.Duration(
 				cfg.Timeout,
 			) * time.Second,
+			Transport: e.client.Transport,
 		}
 	}