🛡️ Sentinel: [HIGH] Fix Event Loop Block in SSRF Validation

[d3mocide]

🚨 Severity: HIGH
💡 Vulnerability: The proxy_stream endpoint in backend/routers/radio.py performed Server-Side Request Forgery (SSRF) validation using validate_safe_url. This function relies on socket.getaddrinfo, which is a synchronous, blocking network call. Calling it directly within the async def function blocked the entire FastAPI asyncio event loop during DNS resolution.
🎯 Impact: An attacker could provide a stream URL that points to a malicious, non-responsive, or extremely slow DNS server. This would tie up the event loop during resolution, preventing the server from handling any other concurrent requests and causing a Denial of Service (DoS).
🔧 Fix: Wrapped the validate_safe_url calls in await asyncio.get_running_loop().run_in_executor(None, validate_safe_url, ...) to offload the blocking DNS resolution to a separate thread, keeping the main event loop responsive.
✅ Verification: Ran python3 -m unittest discover backend/tests/ and confirmed all 146 tests still pass, including the SSRF validation tests. Checked python syntax and docker configurations.

---

PR created automatically by Jules for task 6798578802006811675 started by @d3mocide

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.