fix(cctv): harden the Catalonia catalog fetch and frame-link allowlist

Address review feedback on #595:

- Reject frame links carrying userinfo (user:pass@) in
  normalizeCataloniaImageUrl, so catalog data cannot inject credentials
  into the server-side frame request on an allowlisted host.
- Fetch cameres.xml over https (verified: same 200 body, no redirect),
  refuse redirects with the unread body released, and read the body
  through readResponseTextCapped with a 1 MiB CATALONIA_MAX_CATALOG_BYTES
  cap instead of an unbounded resp.text().
- Add regression tests for userinfo links on every allowed host, the
  refused redirect, and declared and streamed oversize bodies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CHANGELOG.md

@@ -295,7 +295,9 @@ Analyst records for loaded satellites, datacenters and dams, with explicit bound
   hotlinked Barcelona and Terrassa municipal cameras, each partner named as a
   credit beside the shared provider. Ambient-card refresh paced to 3 minutes,
   matching the empirically observed upstream cadence. `CCTV_CATALONIA_MAX_SOURCES`
-  sets the cap and `CCTV_CATALONIA_ENABLED=0` turns the pack off.
+  sets the cap and `CCTV_CATALONIA_ENABLED=0` turns the pack off. The catalog
+  is fetched over https with redirects refused and a 1 MiB body cap, and frame
+  links carrying userinfo are rejected even on an allowlisted host.
 
 - Distinguish PARTIAL vessel snapshots from STALE data in the layer panel, with
   accepted-record counts and unchanged retention, freshness and outage safeguards.