feat: initialize bangwen recruitment aggregation and search engine

- Rust core engine with HTTP ingestion gateway, hybrid search, and white-box resume matching
- Python edge collectors supporting declarative TOML and specialized adapters
- PostgreSQL schema migrations with pgvector embedding support
- Hardened security controls: strict CSP, terminal sanitization, and input boundary validation
- Multi-service container orchestration with dedicated non-root execution

collectors/common/security.py

@@ -0,0 +1,35 @@
+import ipaddress
+from urllib.parse import urlsplit
+
+
+def is_safe_url(
+    url: str,
+    allowed_domains: list[str] | None = None,
+    default_host: str = "",
+) -> bool:
+    try:
+        parts = urlsplit(url)
+        if parts.scheme not in ("http", "https"):
+            return False
+
+        host = (parts.hostname or "").lower()
+        if not host or host in ("localhost", "127.0.0.1", "::1"):
+            return False
+
+        try:
+            ip = ipaddress.ip_address(host)
+            if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
+                return False
+        except ValueError:
+            pass
+
+        domains = [d.lower() for d in (allowed_domains or []) if d]
+        if not domains and default_host:
+            domains = [default_host.lower()]
+
+        if not domains:
+            return True
+
+        return any(host == d or host.endswith("." + d) for d in domains)
+    except Exception:
+        return False