Authorized red-team test target. Two endpoints:
GET /fetch?url=<url> — server-side fetch (SSRF sink). Returns the fetched status, headers, and body prefix.ANY /<anything> — out-of-band collector. Every request is logged to the pod logs and acknowledged with a marker.Health: /healthz, /readyz. This service is intentionally permissive — run it only where you are authorized to test.