ops: Assert Host allowlist reject in validate-check

Empty-upstream Host allowlist is load-bearing: if that gate regresses,
the cache becomes an open LAN reverse proxy again. Unit tests already
cover hostAllowedForDirectFetch, but make validate-check did not probe
the live reject path.

Extend validate-check to GET a depot-like path with Host: evil.example
and a Steam User-Agent, requiring HTTP 400 Invalid URL. Document the
expected reject in README and the validate-config comment.

Fixes #37

docs/examples/validate-config.yaml

@@ -28,6 +28,7 @@
 #
 # After the benchmark run, inspect with:
 #   make validate-check   # full /metrics + hit/miss fields + /lancache-heartbeat
+#                         # also asserts a non-Steam Host is rejected (400) while upstream is empty
 #   # or, manually:
 #   curl -s http://localhost/metrics
 #   curl -s -i http://localhost/lancache-heartbeat   # GET, not HEAD