fix: RemoteFileFetcher::fetch() prüft die URL selbst; Doppelprüfung im Schriften-Upload entfällt

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/Integrations/Divi/Design/DiviFontsUploadAbility.php

@@ -325,12 +325,6 @@ final class DiviFontsUploadAbility implements Ability, RequiresDiviFeatures
         $problems = [];
         $unreachable = false;
         foreach ($urls as $format => $url) {
-            // fetch() does not check the URL itself: a refused URL is never requested (same answer as a failed one).
-            if (! $this->fetcher->allows($url)) {
-                $problems['files.' . $format] = 'nicht abrufbar';
-                $unreachable = true;
-                continue;
-            }
             $tmp = (string) wp_tempnam('lit-mcp-font');
             if ($tmp === '') {
                 return Errors::writeFailed('Die temporäre Datei konnte nicht angelegt werden.');

src/Integrations/Media/RemoteFileFetcher.php

@@ -42,7 +42,7 @@ class RemoteFileFetcher
     }
 
     /**
-     * Streams $url into $tmp; the caller checks allows() first and the size of $tmp afterwards (a body above
+     * Streams $url into $tmp; fetch() checks the URL itself (allows()), the caller checks the size of $tmp afterwards (a body above
      * $maxBytes is cut off at $maxBytes + 1 bytes).
      *
      * @param string $context Names the download in the failure log, e.g. "media import".
@@ -50,6 +50,10 @@ class RemoteFileFetcher
      */
     public function fetch(string $url, string $tmp, int $maxBytes, string $context): ?array
     {
+        if (! $this->allows($url)) {
+            return $this->failed($context, $url, 'URL refused');
+        }
+
         // IPv4 only, for this request only: wp_http_validate_url() checks the IPv4 address
         // (gethostbyname), so an AAAA record must not lead cURL to an unchecked IPv6 target.
         $ipv4 = static function ($handle): void {