Opt-in HTTP loader for images embedded in generated cards.

Each request resolves and validates the destination before connecting. The request URL is rewritten to the selected address while TLS verification and the Host header retain the original hostname, preventing DNS rebinding.

Remote loading is disabled by default and requires an explicit hostname allowlist. Redirect targets are subjected to the same scheme, hostname, DNS, and address checks. Direct external og:image values do not use this module because OgEx emits those URLs without fetching them.

The README's embedded-external example shows the complete allowlist, controller, card HEEx, and generated output.