fix: bypass SSRF DNS resolver for AI API calls

SSRF protection was blocking AI API calls because Go's custom resolver
couldn't resolve external domains (DNS timeout). curl worked because it
uses the system resolver.

Fix: Agent creates MCP client with standard http.Client (no SSRF filter)
since we control the API URLs.

Tested: '帮我看看拓维信息这只股，我有10万元，帮我制定1个月交易计划'
→ Returns professional A-share analysis with entry/exit strategy in 5.8s

agent/agent.go

@@ -9,6 +9,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"strconv"
 	"strings"
 	"time"
@@ -62,7 +63,9 @@ func (a *Agent) EnsureAIClient() {
 			for _, m := range models {
 				apiKey := string(m.APIKey)
 				if apiKey != "" && m.CustomAPIURL != "" {
-					client := mcp.NewClient()
+					// Use standard HTTP client (no SSRF protection) since we control the URLs
+					httpClient := &http.Client{Timeout: 60 * time.Second}
+					client := mcp.NewClient(mcp.WithHTTPClient(httpClient))
 					name := m.CustomModelName
 					if name == "" { name = m.ID }
 					client.SetAPIKey(apiKey, m.CustomAPIURL, name)