Harden PHP feeds: block direct cache access, cap curl redirects

Security review found no exploitable issue — none of the 3 endpoints
accept user input, so there's no injection surface (upstream URLs are
hardcoded constants, output is XML-escaped). These are defense-in-depth
only: deny direct HTTP access to cache/, and cap CURLOPT_MAXREDIRS to
avoid a hung request on a misbehaving upstream.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

php/cache/.htaccess

@@ -0,0 +1,3 @@
+# Empeche l'acces HTTP direct aux fichiers de cache (contenu non
+# sensible, mais autant ne pas l'exposer inutilement).
+Require all denied