fix(cctv): give Catalonia cameras stable ids and pin their frame paths

Ids were built from the feed's fid, which embeds an upstream server-start stamp,
so every upstream restart renamed all cameras (it already had since the PR
fixture). Ids now come from the validated frame URL (cat-sct-<stem>, or host
and path for partner cameras), which also collapses the five duplicate rows.
Frame links must sit directly in each host's frame directory with no explicit
port, and sctidcam must be a bare image filename. Numeric entity decoding
handles hex references and leaves invalid code points as written, so one bad
name no longer empties the pack. Counts in the docs are now ~130.

CHANGELOG.md

@@ -351,14 +351,17 @@
   largest cities) and `CCTV_VEGVESEN_VIDEO=0` keeps stills only. Attributed
   under NLOD 2.0.
 
-- Add Catalonia (Servei Català de Trànsit) as a keyless CCTV source pack: ~135
+- Add Catalonia (Servei Català de Trànsit) as a keyless CCTV source pack: ~130
   cameras from a WFS/GML feed that aggregates SCT's own highway cameras with
   hotlinked Barcelona and Terrassa municipal cameras, each partner named as a
   credit beside the shared provider. Ambient-card refresh paced to 3 minutes,
   matching the empirically observed upstream cadence. `CCTV_CATALONIA_MAX_SOURCES`
   sets the cap and `CCTV_CATALONIA_ENABLED=0` turns the pack off. The catalog
   is fetched over https with redirects refused and a 1 MiB body cap, and frame
-  links carrying userinfo are rejected even on an allowlisted host.
+  links carrying userinfo or an explicit port, or outside the publisher's frame
+  directory, are rejected even on an allowlisted host. Camera ids come from
+  each frame's SCT camera file or image path rather than the feed's
+  restart-dependent feature id, and rows the feed repeats collapse to one.
 
 - Import your own GeoJSON, KML, KMZ and GPX files from DISPLAY or by dropping
   them onto the app. Show, hide, fly to or remove each file for the session.