test: tests para hardening de tools (file, ssh, http, matrix)

40 tests cubriendo:
- file: deny-by-default, path traversal, symlink escape, prefix confusion
- ssh: allowlist, blocklist, sintaxis shell (pipes, subshells, redirects)
- http: SSRF (loopback, IPs privadas, link-local, metadata), dominios
- matrix: room authorization allowlist

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/matrix/matrix_test.go

@@ -0,0 +1,23 @@
+package matrix
+
+import "testing"
+
+func TestValidateRoom_EmptyAllowed(t *testing.T) {
+	if err := validateRoom("!any:server.com", nil); err != nil {
+		t.Fatalf("empty list should allow all: %v", err)
+	}
+}
+
+func TestValidateRoom_Allowed(t *testing.T) {
+	rooms := []string{"!abc:server.com", "!def:server.com"}
+	if err := validateRoom("!abc:server.com", rooms); err != nil {
+		t.Fatalf("room should be allowed: %v", err)
+	}
+}
+
+func TestValidateRoom_Denied(t *testing.T) {
+	rooms := []string{"!abc:server.com"}
+	if err := validateRoom("!evil:server.com", rooms); err == nil {
+		t.Fatal("room should be denied")
+	}
+}