- Add private IP / localhost / non-http protocol validation in resolveApiUrl
- Unify error handling via formatToolError using isActionbookError from SDK
- Wrap register() in try-catch to prevent crashing the host on bad config
- Add 28 new tests covering tool execution, SSRF, proxy bypass, and error paths