fix: return 400 for invalid protocols and unresolvable hostnames (was 500)

src/services/ssrf.ts

@@ -39,7 +39,7 @@ export async function validateUrl(urlStr: string): Promise<{ hostname: string; r
   }
 
   if (!["http:", "https:"].includes(parsed.protocol)) {
-    throw new Error("Only HTTP and HTTPS URLs are allowed");
+    throw new Error("URL protocol not allowed: only HTTP and HTTPS are supported");
   }
 
   const hostname = parsed.hostname;