p1: /v2/scrape, /v1/fetch, auth, CLI, contract tests

Single Fetcher.Fetch on the Guard that holds DenyPrefixes. skipTlsVerification
is ignored. No 502. keys add writes the secret only to --out. Release binary
has no -test-allow-prefix.

internal/guard/guard.go

@@ -42,6 +42,22 @@ type Guard struct {
 	// (home WAN /32s that hairpin through the router into LAN services).
 	// Set from config deny_prefixes / -deny-prefix; never from the URL.
 	DenyPrefixes []netip.Prefix
+	// AllowPrefixes bypasses the predicate. Production config never sets this;
+	// only tests and the sifttest-tagged -test-allow-prefix flag do.
+	AllowPrefixes []netip.Prefix
+}
+
+func (g *Guard) allows(addr netip.Addr) bool {
+	if g == nil {
+		return false
+	}
+	addr = addr.Unmap()
+	for _, p := range g.AllowPrefixes {
+		if p.Contains(addr) {
+			return true
+		}
+	}
+	return false
 }
 
 func (g *Guard) lookup(ctx context.Context, host string) ([]netip.Addr, error) {
@@ -113,6 +129,9 @@ func ParseURL(raw string) (*url.URL, netip.Addr, error) {
 		}
 	}
 	if err := checkPort(port); err != nil {
+		if addr, ok := parseIPLiteral(host); ok {
+			return u, addr, err
+		}
 		return nil, netip.Addr{}, err
 	}
 	if addr, ok := parseIPLiteral(host); ok {
@@ -244,6 +263,11 @@ func (g *Guard) CheckAddr(addr netip.Addr) error {
 	addr = addr.Unmap()
 
 	if g != nil {
+		for _, p := range g.AllowPrefixes {
+			if p.Contains(addr) {
+				return nil
+			}
+		}
 		for _, p := range g.DenyPrefixes {
 			if p.Contains(addr) {
 				return blockedAddr("denied prefix", addr)
@@ -303,7 +327,11 @@ func ipv4Compatible(addr netip.Addr) (netip.Addr, bool) {
 func (g *Guard) CheckURL(ctx context.Context, raw string) (*url.URL, []netip.Addr, error) {
 	u, literal, err := ParseURL(raw)
 	if err != nil {
-		return nil, nil, err
+		if literal.IsValid() && g.allows(literal) {
+			err = nil
+		} else {
+			return nil, nil, err
+		}
 	}
 	if literal.IsValid() {
 		if err := g.CheckAddr(literal); err != nil {
@@ -338,13 +366,16 @@ func (g *Guard) Control(network, address string, _ syscall.RawConn) error {
 	if err != nil {
 		return blocked("dial address " + address)
 	}
-	if err := checkPort(port); err != nil {
-		return err
-	}
 	addr, err := netip.ParseAddr(host)
 	if err != nil {
 		return blocked("dial address not an IP " + host)
 	}
+	if g.allows(addr) {
+		return nil
+	}
+	if err := checkPort(port); err != nil {
+		return err
+	}
 	return g.CheckAddr(addr)
 }