fix(08): apply code review findings (CR-01, CR-02, WR-01–05, IN-01)

- CR-01: fix SSRF bypass — isPrivateIpv6 now delegates ::ffff:<ipv4> to
  isPrivateIpv4, covering 172.16-31.x and 169.254.x ranges
- CR-02: add ParseUUIDPipe to GET /favorites widgetId param + service guard
  so missing widgetId returns 400 instead of leaking all user favorites
- WR-01: link-widget — replace raw 'link.error' key with t('link.error') (4 sites)
- WR-02: favorites-widget — fix load-path error to use t('favorites.error')
- WR-03: widget-catalog-modal — move aria-hidden from outer wrapper to backdrop
- WR-04: calculator — remove duplicate M button (MR clone); MC/MR/M+/M−/MS remain
- WR-05: schema — add FavoriteLink→WidgetInstance FK with onDelete:Cascade
- IN-01: create-widget.dto.ts — update comment from four to eight supported types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/prisma/schema.prisma

@@ -124,13 +124,14 @@ model DashboardLayout {
 }
 
 model WidgetInstance {
-  id         String   @id @default(uuid())
-  userId     String
-  tenantId   String
-  widgetType String
-  config     Json     @default("{}")
-  createdAt  DateTime @default(now())
-  updatedAt  DateTime @updatedAt
+  id             String         @id @default(uuid())
+  userId         String
+  tenantId       String
+  widgetType     String
+  config         Json           @default("{}")
+  createdAt      DateTime       @default(now())
+  updatedAt      DateTime       @updatedAt
+  favoriteLinks  FavoriteLink[]
 
   @@index([userId])
   @@index([tenantId])
@@ -235,16 +236,17 @@ model SmtpConfig {
 }
 
 model FavoriteLink {
-  id        String   @id @default(uuid())
-  userId    String
-  tenantId  String
-  widgetId  String
-  title     String
-  url       String
-  iconUrl   String?
-  position  Int      @default(0)
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
+  id             String         @id @default(uuid())
+  userId         String
+  tenantId       String
+  widgetId       String
+  title          String
+  url            String
+  iconUrl        String?
+  position       Int            @default(0)
+  createdAt      DateTime       @default(now())
+  updatedAt      DateTime       @updatedAt
+  widgetInstance WidgetInstance @relation(fields: [widgetId], references: [id], onDelete: Cascade)
 
   @@index([userId])
   @@index([tenantId])