fix: nightly hardening - redirect-safe remote profile loading

[mouse-value-add]

Problem

loadFromUrl validated the initial URL as HTTPS, but fetch still allowed redirects by default. A hostile endpoint could redirect to a different destination, weakening the trust boundary for remote profile loading.

Approach

• Set redirect: "error" on remote profile fetches to fail closed on redirects.
• Added explicit redirect error mapping to a clear NETWORK_ERROR message.
• Added tests to verify redirect mode is enforced and redirect failures are handled cleanly.

Verification

• npm test -- test/parser/loadFromUrl.test.ts
• npm test
• Result: 17 files, 144 tests passed.

Risks

• URLs that intentionally rely on redirects (for example short links) now fail instead of being followed.

Rollback plan

• Revert commit 4c86579 to restore prior redirect-following behavior.
• Or remove redirect: "error" while keeping the rest of the hardening changes.