Restrict Host-based origin fetches to Steam CDN names.

When upstream is empty the cache used the client Host as the fetch URL, so any LAN client with a spoofed Steam User-Agent could proxy to literal IPs or arbitrary names. Reject those hosts, stop following upstream redirects, and keep path-only cache keys so real Steam CDNs still share entries.

steamcache/steamcache.go

@@ -387,11 +387,10 @@ func newHTTPClient(transport *http.Transport) *http.Client {
 		Timeout:   60 * time.Second, // Optimized timeout for better responsiveness
 		// Add redirect policy for better performance
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			// Limit redirects to prevent infinite loops
-			if len(via) >= 10 {
-				return http.ErrUseLastResponse
-			}
-			return nil
+			// Do not follow redirects. Steam CDN chunk/manifest fetches are
+			// expected to be 200; following Location would let an origin send
+			// the cache at an arbitrary internal URL.
+			return http.ErrUseLastResponse
 		},
 	}
 }