Fetch a URL from the server, trace its redirect chain, and grade its security headers (HSTS, CSP, X-Frame-Options, and more). Public URLs only.