feat: require https://cppalliance.org/ and .html path Link post section

Author: javiercoronadonarvaez

templates/news/v3/create.html

@@ -150,6 +150,8 @@ <h1 class="create-post-page__title">Create Post</h1>
                 </span>
               </span>
             </div>
+            {% comment %} Inline help that explains the cppalliance.org restriction so the disabled button doesn't look mysterious. {% endcomment %}
+            <p class="field__help" x-show="isLink" x-cloak>Auto-Generate only works for <code>.html</code> links from <code>cppalliance.org</code>.</p>
           </div>
 
           {% include "v3/includes/_field_file.html" with name="image" label="Image" accept="image/png,image/jpeg" preview=True alpine_error="errors.image" error=form.errors.image.0 help_text="This should be a PNG or JPEG format and no longer than 1MB" extra_class="field--file-narrow create-post-page__field-image" %}
@@ -195,10 +197,20 @@ <h1 class="create-post-page__title">Create Post</h1>
         get isWriteUp() { return this.postType === 'blog' || this.postType === 'news'; },
         get isLinkType() { return this.postType === 'video' || this.postType === 'link'; },
         get isLink() { return this.postType === 'link'; },
+        // Auto-Generate fetches and summarizes the linked page, so we only
+        // enable it for URLs we trust (cppalliance.org over HTTPS). Other Link
+        // posts are still allowed — they just can't use Auto-Generate.
         get linkUrlValid() {
           const url = (this.externalUrl || '').trim();
           if (!url) return false;
-          try { new URL(url); return true; } catch (_) { return false; }
+          try {
+            const parsed = new URL(url);
+            return (
+              parsed.protocol === 'https:' &&
+              parsed.hostname === 'cppalliance.org' &&
+              parsed.pathname.endsWith('.html')
+            );
+          } catch (_) { return false; }
         },
 
         init() {