fix(backups): pin all resolved addresses in one CURLOPT_RESOLVE entry

libcurl overrides an existing host:port DNS cache entry each time a new
one is added, so one entry per address left only the last pinned. That is
IPv6 whenever the target has AAAA records, which broke every request on
hosts without IPv6. Join them into one comma separated entry instead.

app/Rules/SafeWebhookUrl.php

@@ -111,11 +111,20 @@ class SafeWebhookUrl implements ValidationRule
             return $options;
         }
 
+        // libcurl keeps only the last CURLOPT_RESOLVE entry for a given
+        // host:port pair, so every resolved address must be pinned in a single
+        // comma-separated entry. Emitting one entry per address silently drops
+        // all but the last, which is an IPv6 address whenever the host has AAAA
+        // records -- and that fails instantly on hosts without IPv6 egress.
+        $addresses = implode(',', array_map(
+            fn (string $ip): string => filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) ? '['.$ip.']' : $ip,
+            $target['ips'],
+        ));
+
         $options['curl'] = [
-            CURLOPT_RESOLVE => array_map(
-                fn (string $ip): string => sprintf('%s:%d:%s', $target['host'], $target['port'], filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) ? '['.$ip.']' : $ip),
-                $target['ips'],
-            ),
+            CURLOPT_RESOLVE => [
+                sprintf('%s:%d:%s', $target['host'], $target['port'], $addresses),
+            ],
         ];
 
         return $options;