Address push-SSRF review: defer DNS off enqueue path, disable proxy on pinned path, revalidate on re-registration

- Resolve the guarded endpoint IP lazily inside WebPush::Notification#deliver
  (on the bounded delivery worker) instead of eagerly when the notification is
  built on the serial enqueue path, so a slow resolver can't stall the push job
  before any delivery starts. resolved_endpoint_ip only reads the already-loaded
  endpoint attribute, so it is safe off the AR connection.
- Pin the delivery socket with an explicit nil proxy address so http_proxy/
  https_proxy can't route the request through a proxy that re-resolves the host
  and defeats the ipaddr pin.
- Revalidate an existing subscription on re-registration so a row predating
  endpoint validation gets the same 422 as a fresh create instead of being kept
  alive by touch.
- Regression tests: resolution deferred to delivery, pin survives proxy env,
  legacy invalid row rejected with 422.

test/controllers/users/push_subscriptions_controller_test.rb

@@ -51,6 +51,23 @@ class Users::PushSubscriptionsControllerTest < ActionDispatch::IntegrationTest
     assert_response :unprocessable_entity
   end
 
+  test "re-registering a legacy invalid subscription is rejected with 422" do
+    # A row that predates endpoint validation (saved without validation, as a
+    # sink planted before this shipped could be). Re-POSTing its params must hit
+    # the same 422 as a fresh create, not be kept alive by touch.
+    legacy = users(:david).push_subscriptions.build \
+      endpoint: "https://attacker.example.com/steal", p256dh_key: "123", auth_key: "456"
+    legacy.save!(validate: false)
+
+    assert_no_difference -> { Push::Subscription.count } do
+      post user_push_subscriptions_url, params: {
+        push_subscription: { endpoint: "https://attacker.example.com/steal", p256dh_key: "123", auth_key: "456" }
+      }
+    end
+
+    assert_response :unprocessable_entity
+  end
+
   test "destroy a push subscription via dev mode" do
     assert_difference -> { Push::Subscription.count }, -1 do
       delete user_push_subscription_url(push_subscriptions(:david_chrome))