Remove external service dependencies in migration tests (#36866)

Fix #36859

Replace live third-party API calls in migration tests with a
fixture-based HTTP mock server. Fixtures are committed so tests run
offline by default; live recording is gated per service on an API-token
env var.

Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>

services/migrations/migrate_test.go

@@ -110,6 +110,6 @@ func TestAllowBlockList(t *testing.T) {
 	assert.NoError(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("1.2.3.4")}))
 	assert.Error(t, checkByAllowBlockList("domain.com", []net.IP{net.ParseIP("127.0.0.1")}))
 
-	// reset
-	init("", "", false)
+	// reset to allow local networks (mock servers use 127.0.0.1)
+	init("", "", true)
 }