fix(api): stop /api/grade from fetching arbitrary internal URLs

`/api/grade?url=` handed a caller-supplied string straight to `fetch()`: no
scheme check, no address check, no timeout and no size cap, on a route with
`maxDuration: 300`. Anything the function could reach, a visitor could reach
through it — `169.254.169.254` included — and read back as a 400 or a grade.
The multipart branch had the matching problem: with `bodyParser: false`
nothing bounded the stream it buffered.

The feature is "paste a link to your CV", so a host allowlist isn't on the
table. `fetchRemoteResume` guards where the connection actually lands:

- https only, no embedded credentials, port 443 only — an arbitrary port
  turns this into an internal port scanner.
- Every resolved address is checked against loopback, RFC1918, CGNAT,
  link-local, benchmarking, documentation, multicast and reserved space, v4
  and v6, including the transition formats that hide a v4 address inside a v6
  one. If any record for a host is private the host is refused, so a
  round-robin that mixes public and private answers doesn't get a second roll.
- The socket is pinned to the address we validated, with `servername` and
  `Host` still set to the name, so a DNS rebind can't swap the metadata
  endpoint in between the check and the connect. Validate-then-`fetch()`
  leaves that window open.
- Redirects are followed by hand, three at most, each hop re-parsed and
  re-resolved from scratch — a `Location` is a fresh caller-supplied URL.
- 20s deadline across all hops, and a 10MB cap on both `content-length` and
  the running total, since a chunked response declares nothing.

Failures carry stable codes, so the route answers 4xx instead of falling
through to the 500, and `getErrorMessage` maps them to copy. It now reads the
code before looking at the status: our own 413 knows the route's limit, while
Vercel's plain-text 413 is still the one that mentions its 4.5MB payload cap.

Tests are network-free: address classification both ways, and the URL shapes
refused before a socket opens — decimal and hex loopback encodings among them,
which `new URL()` normalizes and the resolver would otherwise reach happily.
The timeout and both size-cap branches were checked against real origins
locally; those cases stay out of the suite rather than make CI depend on
third-party hosts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xa76D7n4CLkdKt99Su1HRy

Author: lautaropaske

src/pages/api/grade.ts

@@ -1,3 +1,8 @@
+import {
+  fetchRemoteResume,
+  MAX_RESUME_BYTES,
+  ResumeFetchError,
+} from "@/resume-checker/fetch-resume";
 import {
   exampleResponses,
   messages,
@@ -42,8 +47,17 @@ export default async function handler(
   try {
     let pdfBuffer: Buffer;
     if (isMultipartFormData(req)) {
-      const chunks = [];
+      // bodyParser is off, so nothing else bounds this stream: without the
+      // running total a single request could buffer the whole heap away.
+      const chunks: Buffer[] = [];
+      let size = 0;
       for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_RESUME_BYTES) {
+          req.destroy();
+          res.status(413).json({ error: "ResumeTooLarge" });
+          return;
+        }
         chunks.push(chunk);
       }
       pdfBuffer = Buffer.concat(chunks);
@@ -54,9 +68,7 @@ export default async function handler(
         return;
       }
 
-      const response = await fetch(resumeUrl);
-      const arrayBuffer = await response.arrayBuffer();
-      pdfBuffer = Buffer.from(arrayBuffer);
+      pdfBuffer = await fetchRemoteResume(resumeUrl);
     }
 
     const parsed = await pdf(pdfBuffer);
@@ -84,6 +96,14 @@ export default async function handler(
       return;
     }
 
+    // Bad or hostile resume URLs are the caller's fault, and each carries a
+    // stable code the badge can render.
+    if (e instanceof ResumeFetchError) {
+      console.warn(e);
+      res.status(e.status).json({ error: e.code });
+      return;
+    }
+
     if (
       e.message.includes("InvalidPDFException") ||
       e.message.includes("Invalid PDF structure")