[santoshkumarradha]

Problem and behavior

Provider-supplied video polling URLs and HTTP redirects could carry a provider key outside its configured origin. Provider requests now follow redirects only within the original scheme, hostname and effective port. Foreign polling/download URLs receive no provider bearer; failures name the relevant host without exposing signed URL secrets or claiming that a local boundary refusal means the key expired.

The shared policy covers completion streams, custom-compatible tool loops, media, catalog, credits and authentication requests. Caller HTTP clients retain their transport, timeouts and stricter redirect policies.

Verification

• make pr-ready passed, including all touched packages; final make test-quick passed.
• Actual binary, fake keys and loopback endpoints: foreign 307 redirect produced 0 target requests / 0 credentials; same-origin redirect completed with authentication.
• Actual terminal: loaded the media capability and generated mock video. Foreign polling made 1 request / 0 bearer headers and displayed the real host-named failure. Same-origin polling and content download retained authentication and produced the expected mock file.
• Live normal workflow through OpenRouter: automatic mock memory save, fresh-chat recall and file creation passed. All 23 recorded model calls used exactly deepseek/deepseek-v4.1-flash.
• Unit/law checks cover subdomains, ports, scheme changes, redirect limits, caller hooks, malformed signed URLs and safe error categories. An existing router 429 fixture now explicitly disables patient retries so its rating assertions terminate.

Fault injection uses scripted local endpoints; the live model workflow is the normal-operation control. No personal memory or real provider keys appear in the examples.

Closes #1895
Closes #1896