Outbound guard: pin httpVersion and adapter per request

[sgort]

Problem

createOutboundClient in packages/backend/src/utils/outboundHttp.ts (#164, #142) is the client for hosts a caller chooses. It refuses internal addresses at connect time through its own HTTP agents. Two axios request options can still route around those agents:

• httpVersion: 2: the HTTP/2 transport ignores the agents. httpVersion: 1 is pinned in the client defaults, but a per-request value overrides it and the request interceptor does not reset it.
• adapter: 'fetch': the fetch adapter does not use the agents either.

Found by the whole-branch review of #164 and confirmed with a probe. Not reachable today: both callers (sparql.service.ts, triplydb.service.ts) pass fixed config and nothing derived from a request. It becomes reachable as soon as a future caller passes request-derived axios options.

The comment at outboundHttp.ts (~lines 84-86) is also wrong. It says httpVersion chooses between the fetch and http adapters. adapter does that. What httpVersion: 1 prevents is the HTTP/2 transport.

Fix

• Add adapter: 'http' after ...defaults in axios.create.
• In the request interceptor, set request.httpVersion = 1 and request.adapter = 'http' next to the existing resets of proxy, the agents, transport, socketPath and lookup.
• Correct the comment.
• Tests: a per-request { httpVersion: 2 } and a per-request { adapter: 'fetch' } against a name resolving to loopback are still refused with EOUTBOUNDREFUSED.

Related

• Validate caller-supplied endpoints and credentials in the backend proxy routes #142 / fix: validate what the backend is told to call (#142) #164