fix(cctv): give Catalonia cameras stable ids and pin their frame paths

Ids were built from the feed's fid, which embeds an upstream server-start stamp,
so every upstream restart renamed all cameras (it already had since the PR
fixture). Ids now come from the validated frame URL (cat-sct-<stem>, or host
and path for partner cameras), which also collapses the five duplicate rows.
Frame links must sit directly in each host's frame directory with no explicit
port, and sctidcam must be a bare image filename. Numeric entity decoding
handles hex references and leaves invalid code points as written, so one bad
name no longer empties the pack. Counts in the docs are now ~130.

server/providers/cctv/normalize.js

@@ -406,16 +406,24 @@ export function isLikelyCataloniaCoordinate(lat, lon) {
 }
 
 /**
- * Decode decimal numeric HTML character references ("í" -> "í"), the
- * entity form the Catalonia feed uses for accented place names, plus the
- * handful of named entities XML/HTML text commonly carries.
+ * Decode numeric HTML character references, decimal ("í") and hex
+ * ("í") alike, the entity form the Catalonia feed uses for accented
+ * place names, plus the handful of named entities XML/HTML text commonly
+ * carries. A reference that names no valid character (NUL, a surrogate, or
+ * anything past U+10FFFF) is left as written rather than thrown on, so one
+ * bad field cannot fail a whole catalog.
  *
  * @param {string} text
  * @returns {string}
  */
 export function decodeNumericEntities(text) {
   return String(text || '')
-    .replace(/&#(\d+);/g, (_, code) => String.fromCodePoint(Number(code)))
+    .replace(/&#(?:x([0-9a-f]+)|(\d+));/gi, (match, hex, dec) => {
+      const code = hex ? Number.parseInt(hex, 16) : Number(dec);
+      const valid =
+        code > 0 && code <= 0x10ffff && (code < 0xd800 || code > 0xdfff);
+      return valid ? String.fromCodePoint(code) : match;
+    })
     .replace(/&amp;/g, '&')
     .replace(/&quot;/g, '"')
     .replace(/&#39;/g, "'")