[Bug]: favicon requests send private link hosts to Google #5835

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/web

Steps to reproduce

1. Open a preview tab pointing at http://localhost:5173.
2. Post a markdown link to http://192.168.1.10:8080 in a thread.
3. Watch the outbound requests from web and from mobile.

Expected behavior

The app sends no private host name to a third party. It renders the fallback that each call site already has: a glyph on mobile, a GlobeIcon in web chat, and null from the preview helper.

Actual behavior

The app requests https://www.google.com/s2/favicons?domain=localhost%3A5173&sz=32 and https://www.google.com/s2/favicons?domain=192.168.1.10&sz=32

Three call sites build the URL from a link host:

apps/mobile/src/features/threads/ThreadFeed.tsx:284   MarkdownExternalLink
apps/web/src/components/ChatMarkdown.tsx:858          MarkdownLinkFavicon
apps/web/src/lib/favicon.ts:10                        faviconUrlForOrigin

The preview helper guards the protocol but never the host:

if (url.protocol !== "http:" && url.protocol !== "https:") return null;
return `${FAVICON_PROVIDER}?domain=${encodeURIComponent(url.host)}&sz=${size}`;

resolveMarkdownLinkPresentation marks every http: and https: link as external, so the host can be private:

// apps/mobile/modules/t3-markdown-text/src/markdownLinks.ts:356
if (parsed.protocol === "http:" || parsed.protocol === "https:") {
  return { kind: "external", href: parsed.toString(), host: parsed.hostname };
}

The preview tab strip matters most. Its doc comment describes it as a preview helper, and a preview URL usually points at a dev server or a tailnet host. So it leaks on the normal path, not the rare one. Google cannot resolve a private host, so every one of these requests also fails.

Impact

Major degradation or frequent failure

Version or commit

main @ 1a003e3

Environment

apps/web and apps/mobile. Local development servers and Tailscale hosts appear in threads and previews often. Issue #5818 shows that users pair over 100.64.0.0/10. I did not confirm whether apps/desktop inherits the web path.

Logs or stack traces

GET https://www.google.com/s2/favicons?domain=localhost%3A5173&sz=32
GET https://www.google.com/s2/favicons?domain=192.168.1.10&sz=32
-> image load error, host added to failedFaviconHosts

Workaround

Post no links to private hosts, and open no previews on them. Neither avoidance is practical during development.