Stop fetching untrusted catalog URLs on submission

Description

The pitch.

## Summary

- Stop the catalog form from fetching user-submitted URL and GitHub sources.
- Store new link submissions with `reachable: null`, matching the existing API behavior and making uncertainty explicit.
- State in human and machine-readable docs that catalog registration is discovery only: it does not verify, install, authorize, endorse, host, or execute the submitted target.

## Why

The server action followed redirects while fetching an arbitrary submitted URL. That exposed a present SSRF boundary: a submission could target loopback, private, link-local, or metadata-network resources directly or through redirects. Submission-time liveness is not required to create a catalog entry, so this fix removes the untrusted server-side request instead of relying on an incomplete address denylist or a DNS check that can race the connection.

The server-fetch boundary was surfaced by legacy PR #80 from @athiye. This is a fresh implementation against current `main`; no contributor code was executed or copied.

## Scope boundary

This PR does not port the legacy reputation scenario, establish endpoint liveness, inspect linked content, or imply that a discoverable entry is safe, installed, authorized, endorsed, hosted, or running. Any future live probe belongs in an isolated observer with explicit network policy and timestamped evidence.

## Verification

- Dashboard tests: 44 passed
- Dashboard typecheck: passed
- Changed-file lint and diff check: passed
- Independent re-review: no critical, important, or minor findings