Every outbound federation request goes through one guarded client

Infrastructure/Http adds the client the roadmap's S3 and S4 ask for:
- the connect callback resolves the name itself and refuses loopback,
  private, link-local, CGNAT, documentation, multicast, ULA, NAT64, 6to4,
  Teredo and IPv4-mapped/compatible forms, then connects to the vetted
  address, so DNS rebinding cannot swap it afterwards;
- redirects are followed by hand, at most three, each one re-checked;
- bodies are capped at 1 MB after decompression, only JSON media types are
  read, every request has a 15 s budget, and a refused URL is not asked
  again for five minutes.

Actor and WebFinger fetches and inbox deliveries all use it. Test networks
can switch on Federation:AllowPrivateNetworks/AllowPlainHttp; startup
refuses both in Production.

PrivaPub.Tests (xUnit v3) starts with the address table and the fetcher's
limits against an in-process peer; build.yml and deploy.yml run it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Middleware/SocialPubConfigurations.cs

@@ -14,6 +14,8 @@ using PrivaPub.Services.ClientToServer.Public;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Federation.Inbox;
+using PrivaPub.Infrastructure.Http;
+using Microsoft.Extensions.Options;
 
 namespace PrivaPub.Middleware
 {
@@ -32,14 +34,19 @@ namespace PrivaPub.Middleware
 			//.AddHostedService<GroupsCleanerWorker>()
 			//.AddHostedService<PoliciesCleanerWorker>();
 		}
-		public static IServiceCollection PrivaPubFederationConfiguration(this IServiceCollection service)
+		public static IServiceCollection PrivaPubFederationConfiguration(this IServiceCollection service, IConfiguration configuration)
 		{
-			service.AddHttpClient(RemoteActorService.HttpClientName, client =>
-			{
-				client.Timeout = TimeSpan.FromSeconds(20);
-				client.DefaultRequestHeaders.UserAgent.ParseAdd($"PrivaPub/{BuildInfo.Ref}");
-			});
+			service.Configure<FederationOptions>(configuration.GetSection("Federation"));
+			service.AddHttpClient(FederationHttp.ClientName, (provider, client) =>
+				{
+					var baseAddress = provider.GetRequiredService<IOptionsMonitor<AppConfiguration>>().CurrentValue.BackendBaseAddress?.TrimEnd('/');
+					client.Timeout = FederationHttp.RequestTimeout;
+					client.DefaultRequestHeaders.UserAgent.ParseAdd($"PrivaPub/{BuildInfo.Ref} (+{baseAddress}/)");
+				})
+				.ConfigurePrimaryHttpMessageHandler(provider =>
+					SafeHttpHandlerFactory.Create(provider.GetRequiredService<IOptions<FederationOptions>>().Value));
 			return service
+				.AddSingleton<IFederationHttp, FederationHttp>()
 				.AddSingleton<ILocalActorService, LocalActorService>()
 				.AddSingleton<IRemoteActorService, RemoteActorService>()
 				.AddSingleton<IDeliveryService, DeliveryService>()