test(ssrf): lock the pre-existing moodLog and ntfy host pins

Extend the SSRF pin inventory to also assert the requirePublicHost pins
already present on the user/operator-supplied moodLog push/sync webhooks
and the ntfy sender, so the full set of overridable-host egress points
is CI-guarded and a future edit that drops one reds here.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lib/__tests__/ssrf-pin-inventory.test.ts

@@ -35,6 +35,23 @@ describe("SSRF requirePublicHost pin inventory", () => {
     expect(read("geo.ts")).toMatch(/requirePublicHost:\s*true/);
   });
 
+  // v1.11.2 product-lead M2 (optional) — lock the PRE-EXISTING user/operator
+  // webhook pins too, so the full inventory is CI-guarded and a future edit
+  // that drops one of these reds here rather than shipping silently.
+  it("moodLog push pins the user-supplied webhook outbound", () => {
+    expect(read("moodlog/push.ts")).toMatch(/requirePublicHost:\s*true/);
+  });
+
+  it("moodLog sync pins the user-supplied webhook outbound", () => {
+    expect(read("moodlog/sync.ts")).toMatch(/requirePublicHost:\s*true/);
+  });
+
+  it("ntfy sender pins the user/operator-supplied server outbound", () => {
+    expect(read("notifications/senders/ntfy.ts")).toMatch(
+      /requirePublicHost:\s*true/,
+    );
+  });
+
   it("local AI client keeps the pin CONDITIONAL (LAN escape hatch)", () => {
     const src = read("ai/local-client.ts");
     // Must carry the conditional form …