directory.toml's fetch_internal lets the refresher reach listed addresses (#329)

3bfd8f8 gave the refresher the guard with no exceptions, which broke
the browser suite: its directory refreshes fixture feeds on 127.0.0.1,
and five Directory tests waited on listings that never filled. The
cargo tests passed because none of them fetches over HTTP.

directory.toml takes fetch_internal as config.toml does, empty by
default; the suite's lists 127.0.0.1. Production's has none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/directory/src/main.rs

@@ -102,7 +102,7 @@ async fn serve(path: &std::path::Path) -> Result<()> {
         .filter(|u| !u.trim().is_empty())
         .with_context(|| format!("{} is not set: the directory needs a database URL", cfg.database_url_env))?;
     let store = Store::open(&url, true).await.context("opening the database")?;
-    let dir = Directory::new(store, vec![])?;
+    let dir = Directory::new(store, vec![], ipx_feed::guard::Allowed::parse(&cfg.fetch_internal)?)?;
     let dropped = dir.set_tokens(tokens).await?;
 
     let listener =