Sync per-hop destination check: scheme + hostname-literal policy.
Returns a rejection reason or null. DNS names pass here and get their
resolved addresses checked in fetchMediaBytes (async). Exported pure
so the policy is testable without any network.
Sync per-hop destination check: scheme + hostname-literal policy. Returns a rejection reason or null. DNS names pass here and get their resolved addresses checked in fetchMediaBytes (async). Exported pure so the policy is testable without any network.