image_url is unvalidated and the image download is uncapped

open   by a73x

Labels: backlog

From the pre-launch security audit (finding API-5, ranked #4 of the outstanding set).

`image_url` on VM create is neither validated nor size-capped. It is SSRF-shaped, but
self-directed: a tenant may only place VMs on their own hosts, so the request originates
from the tenant's own host, not the control plane. The genuinely live half is the
**unbounded download** — a create can point at an arbitrarily large URL and the host
fetches it with no cap.

**Fix.** Validate the scheme/host, and cap the fetched image size (fail the create past
a ceiling rather than filling the host's disk). Authenticated-tenant only; Low–Medium.