safeImageURL and ValidURLRef refused only //, so a stored og_image of
/\evil.example/x.png loaded a third-party image in the admin. Both now
refuse /\ like models.validTarget already does.
- golem15.seo.robots singleton (UI-SPEC C10): staging callout and the
served file (P4); the plugin's own extension adds the editor, the
tester and the AI bots tab, saved to the robots row with history
- field type robotstxt (E4, live lint, size meter; Decode refuses over
500 KB) and widget golem15-seo-robotstester (E5) on robots_test, which
tests the unsaved text and switches through grobotstxt
- saving rules that block a noindex address answers robots.blocks_noindex
