p2: fence document tags, atomic fleetctx, harden workspace

Neutralise </document and <document in page text. Counters are
atomic.Uint64. Workspace names are [A-Za-z0-9_-] and PathEscaped;
foreign workspace_id rows are dropped. Wayback closest.url must be
https://web.archive.org. archive.today snapshot_at is Memento-Datetime
or null.

internal/recover/recover_test.go

@@ -69,6 +69,22 @@ func TestWaybackAvailable(t *testing.T) {
 	}
 }
 
+func TestWaybackRejectsForeignHost(t *testing.T) {
+	avail, _ := json.Marshal(map[string]any{
+		"archived_snapshots": map[string]any{
+			"closest": map[string]any{"available": true, "url": "https://evil.example/x", "timestamp": "20240101120000"},
+		},
+	})
+	f := &fakeFetch{
+		body: map[string][]byte{"https://archive.org/wayback/available": avail},
+		ct:   map[string]string{"https://archive.org/wayback/available": "application/json"},
+	}
+	_, err := Try(context.Background(), f, "https://example.com/x")
+	if err == nil {
+		t.Fatal("want reject")
+	}
+}
+
 func TestWaybackUnavailableGoesToArchiveToday(t *testing.T) {
 	avail, _ := json.Marshal(map[string]any{"archived_snapshots": map[string]any{}})
 	page := []byte("<html><head><title>Saved</title></head><body>" + strings.Repeat("ok ", 200) + "</body></html>")