fix(fetchers): enforce docs site outbound policy

[chaliy]

What

Enforce FetchKit's outbound policy for DocsSiteFetcher, covering direct llms.txt requests, llms probe requests, and docs-page fetches.

Closes #94.

Why

DocsSiteFetcher used its own redirect-following client, which bypassed DNS pinning, private-IP blocking, and manual redirect validation. That let docs and llms.txt requests ignore the default SSRF posture.

How

• route direct llms.txt fetches through the shared hardened request helper
• route llms-full.txt / llms.txt probes and fallback docs-page fetches through the same transport path
• add SSRF regressions for direct loopback llms.txt fetches and localhost -> 127.0.0.1 redirect enforcement

Risk

• Low
• docs-site fetches now use the hardened redirect flow; the main regression risk is around llms probing and redirect handling on legitimate docs sites

Checklist

• Unit tests are passed
• Smoke tests are passed
• Documentation is updated
• Specs are up to date and not in conflict