SSRF URL tool demo

Run: node test.mjs
Observed: Node.js v24.13.0 on Windows, 2026-11-08. No dependencies.

url-tool.mjs is the application boundary; expose fetchDocument only.
POLICY and createDocumentFetcher are trusted application configuration, never model arguments.
Replace the example production hostname only after destination and egress review.
The tests use synthetic local HTTP servers and make no external requests.
Parser tests do not probe private services or metadata.
These tests do not verify production DNS, TLS, IPv6 or egress restrictions.
