[tmolavi]

Summary

Temporarily disables implicit remote URL fetching in extract_website_context to prevent SSRF through direct URL input and URL-shaped topics.

Changes

• Keep URL-derived domain/brand heuristics for prompt generation.
• Make remote metadata fetching explicit opt-in via fetch_remote=True.
• Preserve topic-based generation and local export/file ingestion.
• Add regression tests proving no network call occurs by default and opt-in behavior remains explicit.

Verification

• python3 -m pytest tests/ -q
• Result: 10 passed

Scope

• Review-only; do not merge automatically.
• No Hermes, server, or paid-service changes.