fix(#259): validate host in pairing string to prevent SSRF (#344)

Add robust validation for hosts provided through URI or Base64 pairing
strings to prevent Server-Side Request Forgery (SSRF). The application
now rejects loopback addresses (like localhost, 127.0.0.1, 0.0.0.0),
link-local addresses, and any-local addresses, while continuing to allow
remote connections to site-local addresses, custom remote domains,
and VPN networks (like Tailscale). The DNS resolution operates securely
on the IO dispatcher to ensure main-thread safety. Included tests verify
both rejection of invalid hosts and seamless parsing of valid ones.

app/src/main/res/values/strings.xml

@@ -178,6 +178,7 @@
     <string name="connect_error_refused">Connection refused – is Hermes running?</string>
     <string name="connect_error_resolve">Could not resolve host</string>
     <string name="connect_error_connection_failed">Connection failed: %1$s</string>
+    <string name="connect_error_invalid_host">Invalid or forbidden host in pairing string</string>
     <string name="connect_error_missing_fields">Malformed pairing string — missing host, port, or token</string>
     <string name="connect_error_malformed">Malformed pairing string — expected URL or Base64-encoded JSON</string>
     <string name="connect_error_parse_failed">Failed to parse pairing string: %1$s</string>