feat: add OPDS catalogs on desktop and mobile

[cha1latte]

Summary

• add OPDS 1 and OPDS 2 catalog browsing on desktop and mobile
• include Project Gutenberg and a Chinese-language Gutenberg catalog, plus custom anonymous or HTTP Basic-auth catalogs
• import downloaded books transactionally while carrying catalog metadata into Book Details
• keep catalog passwords in Expo SecureStore or the desktop OS keyring, never in synced JSON or logs

Security and reliability

• manually validates redirects and strips credentials across origins
• blocks HTTPS downgrades and non-local plain HTTP catalogs
• bounds feed, descriptor, cover, and acquisition downloads
• supports timeout/cancellation with request-scoped transport cleanup
• sanitizes catalog-provided text and opens desktop external links through the controlled Tauri path

Dependency

This PR depends on #689 (fix: fill imported book metadata). Until #689 merges, GitHub shows that metadata foundation in this diff; after it merges, this PR will automatically shrink to the OPDS changes.

This PR does not depend on #690 (MOBI vectorization).

Verification

• core: 891 tests passed
• Expo/mobile: 87 tests passed; TypeScript passed
• desktop: 68 tests passed; production build passed
• Rust/Tauri: cargo check passed
• OPDS-scoped Biome check: 82 files passed (existing warnings only)
• git diff --check passed
• independent final review: no Critical, Important, or Minor findings
• live Gutenberg proof: opened both built-ins, followed the advertised OpenSearch descriptor over HTTPS, searched for A Modest Proposal, parsed four results, and downloaded a valid EPUB through the production acquisition path
• Android Pixel 9a proof: both built-ins rendered; Chinese Gutenberg returned Chinese-language books; custom anonymous/Basic-auth controls rendered; Gutenberg search, format selection, download, cover extraction, library import, and Book Details all passed against the PR bundle
• the Android pass exposed raw HTML tags in persisted OPDS descriptions; fixed at the acquisition boundary, re-imported the book, and verified readable plain text on-device with a focused 37-test regression suite
• loopback proof covered Basic auth, bad/unsupported authentication, cross-origin credential stripping, malformed/oversized responses, cancellation, and cleanup

Manual proof still pending

• iOS device and assistive-technology pass
• installed desktop smoke test with a real OS keychain
• live Calibre catalog (Calibre was not installed)

Out of scope

OAuth, lending, purchasing, and DRM are not included.