fix(08): apply code review findings (CR-01, CR-02, WR-01–05, IN-01)

- CR-01: fix SSRF bypass — isPrivateIpv6 now delegates ::ffff:<ipv4> to
  isPrivateIpv4, covering 172.16-31.x and 169.254.x ranges
- CR-02: add ParseUUIDPipe to GET /favorites widgetId param + service guard
  so missing widgetId returns 400 instead of leaking all user favorites
- WR-01: link-widget — replace raw 'link.error' key with t('link.error') (4 sites)
- WR-02: favorites-widget — fix load-path error to use t('favorites.error')
- WR-03: widget-catalog-modal — move aria-hidden from outer wrapper to backdrop
- WR-04: calculator — remove duplicate M button (MR clone); MC/MR/M+/M−/MS remain
- WR-05: schema — add FavoriteLink→WidgetInstance FK with onDelete:Cascade
- IN-01: create-widget.dto.ts — update comment from four to eight supported types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/favorites/icon-discovery.service.ts

@@ -55,16 +55,25 @@ function isPrivateIpv4(address: string): boolean {
 function isPrivateIpv6(address: string): boolean {
   const lower = address.toLowerCase();
 
-  return (
+  if (
     lower === '::' ||
     lower === '::1' ||
     lower.startsWith('fc') ||
     lower.startsWith('fd') ||
     lower.startsWith('fe80:') ||
-    lower.startsWith('::ffff:127.') ||
-    lower.startsWith('::ffff:10.') ||
-    lower.startsWith('::ffff:192.168.')
-  );
+    lower.startsWith('ff')
+  ) {
+    return true;
+  }
+
+  // IPv4-mapped IPv6 (::ffff:<ipv4>) — delegate to isPrivateIpv4 to cover all
+  // RFC 1918 ranges (10.x, 172.16-31.x, 192.168.x) and 169.254.x link-local
+  const v4MappedMatch = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4MappedMatch) {
+    return isPrivateIpv4(v4MappedMatch[1]);
+  }
+
+  return false;
 }
 
 function isPrivateIpAddress(address: string): boolean {