fix: close remaining audit gaps for loopback redirects and usage durability

Propagate loopback SSRF policy through redirect chains, block cross-port localhost pivots, harden proxy-test host validation, and improve usage persistence retries with sql.js flush.

Co-authored-by: Cursor <cursoragent@cursor.com>