## Summary
- `is_public_url`'s SSRF guard rejects any URL resolving to an RFC1918 address -- correct in general, but a LAN-based cluster's own public-facing hostnames (`plevion.com` et al., via MetalLB) are themselves private IPs, so every interactive-overlay source pointed at this platform's own frontend-overlays render pages always failed with `COMP_SOURCE_003` ("URL must resolve to a public address"), surfaced to the operator as a generic "Error al crear la fuente".
- Adds `ALLOW_PRIVATE_OVERLAY_URLS` (off by default) to bypass the private-address check specifically -- loopback and link-local still always reject. Not trusted alone: also requires `is_local_environment()`, so a misconfigured/copy-pasted `ENVIRONMENT_NAME` on a real deployment can't open this up by itself.