agent: allow only public addresses as single-agent targets unless allowed_target_cidrs says otherwise

backend/agent/src/MoShiro.Agent/AgentConfig.cs

@@ -98,7 +98,7 @@ public sealed class LimitsSection
     [JsonPropertyName("max_total_pps")]
     public long MaxTotalPps { get; set; } = 20_000;
 
-    /// <summary>默认为空：不允许执行任何目标任务。</summary>
+    /// <summary>单个 Agent 任务（外部目标）能探测的网段。默认为空：只允许公网地址，内网、回环、链路本地等一律拒绝；写了就只允许列出的网段（可以包含内网）。</summary>
     [JsonPropertyName("allowed_target_cidrs")]
     public List<string> AllowedTargetCidrs { get; set; } = [];