Keep a link preview's link and image off this Campfire's own host

A preview belongs to the page it previews, so both URLs point somewhere
else. An absolute URL on our own host passed the scheme and host checks,
and every reader's browser fetched it with their session attached, which
turns a message into a GET request made on the reader's behalf.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

test/controllers/rooms_controller_test.rb

@@ -35,6 +35,22 @@ class RoomsControllerTest < ActionDispatch::IntegrationTest
     assert_match "Free cookies", response.body
   end
 
+  test "show renders a link preview written by hand without its image pointed at this Campfire" do
+    room = rooms(:watercooler)
+    own_url = room_url(room, host: "www.example.com")
+    post room_messages_url(room, format: :turbo_stream), params: { message: {
+      body: link_preview_body(href: own_url, url: own_url),
+      client_message_id: "same-host-preview" } }
+    assert_response :success
+
+    get room_url(room)
+
+    assert_response :success
+    assert_no_match %r{<img src="#{Regexp.escape(own_url)}"}, response.body
+    assert_no_match %r{<a rel="noreferrer" target="_blank" href="#{Regexp.escape(own_url)}"}, response.body
+    assert_match "Free cookies", response.body
+  end
+
   test "show renders an unfurled link preview" do
     room = rooms(:watercooler)
     post room_messages_url(room, format: :turbo_stream), params: { message: {