https only, the golem15.golem.ssrf.allowed_hosts allowlist (overridden by
GOLEM15_SSRF_ALLOWED_HOSTS) with dotted-suffix entries, and a resolve-time
check that every address is public, judged by fetchguard.IsPrivateAddr.
Failures carry PHP's RuntimeException messages.
- Prompt, Payload and AIResponse value objects ported from Golem15.Golem
- OpenAIAdapter: chat completions mapping with PHP's response_format,
max_completion_tokens and reasoning_effort rules
- AIService.Send through fetchguard (TrustedMode for operator models,
PublicOnlyMode otherwise) with PHP's failure messages
- config defaults for the SSRF allowlist and the AI timeout, lang, README
