refactor: add capability-scoped network core

[chhoumann]

Summary

• add unforgeable, purpose-scoped network capabilities bound to opaque feed and episode handles
• add strict URL and address classification, exact private-origin grants, core-owned DNS selection, peer-address pinning, manual redirect reclassification, and HTTPS downgrade rejection
• add a shared bounded scheduler with fixed lane limits, total deadlines, revocation, queue limits, and fail-closed invariant handling
• add bounded buffered-body handling with fixed per-resource byte and chunk limits; episode audio remains deliberately non-bufferable
• keep this as a dark foundation with no runtime imports or behavior changes yet

Security properties

• raw targets, resolver access, adapter access, and executable hop methods stay behind ECMAScript private transport fields and methods
• the trusted adapter contract requires a direct connection to the selected address, normal TLS verification, actual peer reporting, manual redirects, prompt abort, and one-shot close settlement
• redirect hops are re-parsed, re-classified, re-resolved, and re-pinned under one fixed operation deadline
• errors expose only closed codes and registered target-free labels; arbitrary adapter, resolver, body, and close failures are sanitized
• capability revocation and authority disposal abort active work, close responses, and prevent late buffered bytes from returning

Verification

• npm run lint
• npm run format:check
• npm run typecheck
• npm run build
• npm run test - 87 files, 1,450 tests
• npm run check:a11y - 0 errors and 0 warnings
• uv run --with-requirements docs/requirements.txt mkdocs build -f docs/mkdocs.yml -d site
• focused network suite - 5 files, 264 tests
• three independent read-only hostile reviews - no remaining P1 or P2 findings

Real Obsidian verification was not performed because this PR intentionally has no runtime wiring. Runtime adapter integration, mobile capability validation, and end-user flow proof remain later release gates.

Release and migration impact

• no persisted-schema change
• no user-visible behavior change
• no release version expected from this refactor: commit

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	e600d9c
Status:	✅  Deploy successful!
Preview URL:	https://7360e6c4.podnotes.pages.dev
Branch Preview URL:	https://refactor-capability-scoped-t.podnotes.pages.dev

View logs