Result URL import

The admin workflow is intentionally two-step: source retrieval and parsing first, explicit import second. Remote retrieval only accepts HTTPS on golf.se, www.golf.se, and mingolf.golf.se. DNS results are rejected when they resolve to private, loopback, link-local, multicast or reserved addresses. Redirect destinations are validated again. Responses are limited to HTML and 2 MB.

Preview documents are signed with the Flask secret and expire after 30 minutes. Confirmed documents still use import_result_document() as the only database write path.