fix(security): harden authentication and outbound targets (#1877)

* fix(security): harden auth and outbound targets

* fix(security): prevent login lockout and honor trusted schemes

docs/features/git-sources.mdx

@@ -97,6 +97,8 @@ Tick **Deploy after create** to run `docker compose up -d` immediately after the
 | **Authentication** | **Public (no auth)** for public repos, **Personal Access Token** for private HTTPS repos, or **SSH deploy key** for private SSH repos |
 | **Apply behavior** | See the three modes below |
 
+Private repository hosts on your LAN or VPN are supported. Sencho refuses repository targets that resolve to loopback, link-local, multicast, or selected special-use addresses.
+
 Saving runs a reachability check against the repository. If the URL is wrong, the token is invalid, the ref does not exist, or a file is missing, Sencho surfaces the error inline and nothing is persisted.
 
 ### Multiple compose files

docs/features/multi-node.mdx

@@ -271,6 +271,8 @@ http://100.64.0.2:1852     ← Tailscale IP, encrypted by the VPN tunnel
 
 All traffic between nodes is encrypted by the VPN. Sencho does not need to do anything additional.
 
+Remote node URLs may use private LAN, VPC, or VPN addresses. Sencho refuses targets that resolve to loopback, link-local, multicast, or selected special-use addresses.
+
 #### Reverse proxy (Caddy, Nginx, Traefik)
 
 If you prefer TLS termination at each node, place a reverse proxy in front of each Sencho instance. [Caddy](https://caddyserver.com/) is the simplest option; it auto-provisions HTTPS certificates from Let's Encrypt with zero configuration: