feat(network): add opt-in allow local/private network setting

Add a setting that relaxes the SSRF guard so extensions and built-in network code can reach private/local/loopback targets, for users routing traffic through a local proxy or custom DNS. Disabled by default. Wired end-to-end: Go backend (SetAllowPrivateNetwork toggles isPrivateIP guard), Android/iOS platform bridge, Dart settings model/provider, and a toggle in Download settings.

lib/models/settings.dart

@@ -55,6 +55,8 @@ class AppSettings {
   downloadNetworkMode; // 'any' = WiFi + Mobile, 'wifi_only' = WiFi only
   final bool
   networkCompatibilityMode; // Try HTTP + allow invalid TLS cert for API requests
+  final bool
+  allowLocalNetwork; // Allow requests to private/local network targets (local proxy / custom DNS)
   final String
   songLinkRegion; // SongLink userCountry region code used for platform lookup
   final bool
@@ -135,6 +137,7 @@ class AppSettings {
     this.autoExportFailedDownloads = false,
     this.downloadNetworkMode = 'any',
     this.networkCompatibilityMode = false,
+    this.allowLocalNetwork = false,
     this.songLinkRegion = 'US',
     this.nativeDownloadWorkerEnabled = false,
     this.localLibraryEnabled = false,
@@ -200,6 +203,7 @@ class AppSettings {
     bool? autoExportFailedDownloads,
     String? downloadNetworkMode,
     bool? networkCompatibilityMode,
+    bool? allowLocalNetwork,
     String? songLinkRegion,
     bool? nativeDownloadWorkerEnabled,
     bool? localLibraryEnabled,
@@ -275,6 +279,7 @@ class AppSettings {
       downloadNetworkMode: downloadNetworkMode ?? this.downloadNetworkMode,
       networkCompatibilityMode:
           networkCompatibilityMode ?? this.networkCompatibilityMode,
+      allowLocalNetwork: allowLocalNetwork ?? this.allowLocalNetwork,
       songLinkRegion: songLinkRegion ?? this.songLinkRegion,
       nativeDownloadWorkerEnabled:
           nativeDownloadWorkerEnabled ?? this.nativeDownloadWorkerEnabled,

lib/models/settings.g.dart

@@ -56,6 +56,7 @@ AppSettings _$AppSettingsFromJson(Map<String, dynamic> json) => AppSettings(
       json['autoExportFailedDownloads'] as bool? ?? false,
   downloadNetworkMode: json['downloadNetworkMode'] as String? ?? 'any',
   networkCompatibilityMode: json['networkCompatibilityMode'] as bool? ?? false,
+  allowLocalNetwork: json['allowLocalNetwork'] as bool? ?? false,
   songLinkRegion: json['songLinkRegion'] as String? ?? 'US',
   nativeDownloadWorkerEnabled:
       json['nativeDownloadWorkerEnabled'] as bool? ?? false,
@@ -130,6 +131,7 @@ Map<String, dynamic> _$AppSettingsToJson(
   'autoExportFailedDownloads': instance.autoExportFailedDownloads,
   'downloadNetworkMode': instance.downloadNetworkMode,
   'networkCompatibilityMode': instance.networkCompatibilityMode,
+  'allowLocalNetwork': instance.allowLocalNetwork,
   'songLinkRegion': instance.songLinkRegion,
   'nativeDownloadWorkerEnabled': instance.nativeDownloadWorkerEnabled,
   'localLibraryEnabled': instance.localLibraryEnabled,