fix: maintain localhost validation for remote transport URLs

Ensure that template variable validation doesn't bypass the existing
IsValidRemoteURL check that prevents localhost URLs in remote transports.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: tadasant

internal/validators/validators.go

@@ -360,6 +360,11 @@ func validateRemoteTransport(obj *model.Transport) error {
 			}
 			return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL)
 		}
+
+		// Additional check: reject localhost URLs for remotes (like the old IsValidRemoteURL did)
+		if !IsValidRemoteURL(obj.URL) {
+			return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL)
+		}
 		return nil
 	default:
 		return fmt.Errorf("unsupported transport type for remotes: %s (only streamable-http and sse are supported)", obj.Type)