Small follow-ups from the outbound-target work (#142)

[sgort]

Small follow-ups found while reviewing #164 (#142). None changes behaviour, so they were not worth holding the merge for.

• Unreachable IPv6 entries. In packages/backend/src/utils/outboundUrl.ts, the internalV6 list's ::/128 and ::1/128 entries can no longer match. The IPv4-compatible decoding turns :: and ::1 into 0.0.0.0 and 0.0.0.1, which the IPv4 list already refuses. Remove them, or say in a comment why they stay.
• A refused redirect is hard to recognise. When guardRedirect refuses a redirect, axios rejects with ERR_FR_REDIRECTION_FAILURE, and the OutboundRefusedError (code EOUTBOUNDREFUSED) sits only at err.cause.cause. A refused DNS lookup surfaces as EOUTBOUNDREFUSED directly. Nothing branches on the code today, so nothing breaks. If something should, unwrap the cause chain in a response interceptor so that both refusals look the same.
• test-connection schema. POST /v1/triplydb/test-connection now requires config.baseUrl, account and dataset at runtime. Its request schema in openapi.yaml is still a loose inline config: { type: object } with no required list.
• Missing conformance assertion. The #142 POST /v1/dmns/process/deploy target tests in dmn.routes.test.ts check that a mismatching operatonUrl gets a 400. They do not call expectToMatchOperation on it, unlike the file's other 400 tests.
• Weak credential-leak test. The same block asserts that the credentials are not passed on with not.toContain on the call's argument array. That is array membership, not a deep search. It is enough while deployProcess takes no credentials at all, but a deep check is sturdier.
• Spec names the wrong file. docs/superpowers/specs/2026-09-18-outbound-targets-design.md still calls the connect-time guard src/utils/guardedAgent.ts. The file is src/utils/outboundHttp.ts.

Related

• Validate caller-supplied endpoints and credentials in the backend proxy routes #142 / fix: validate what the backend is told to call (#142) #164