Add recon form fingerprint library and SSRF canary mode.

Score crawl inputs by SSRF-prone field names and register ping-back canaries for operator paste confirmation.

server/internal/recon/canary.go

@@ -0,0 +1,17 @@
+package recon
+
+import "strings"
+
+func BuildSSRfCanaryURL(base, scanID string) string {
+	base = strings.TrimSpace(base)
+	if base == "" {
+		base = "https://localhost"
+	}
+	if strings.HasPrefix(base, "http://") {
+		base = "https://" + strings.TrimPrefix(base, "http://")
+	}
+	if !strings.HasPrefix(base, "https://") {
+		base = "https://" + base
+	}
+	return strings.TrimRight(base, "/") + "/recon/ping/" + scanID
+}