Harden PHP feeds: block direct cache access, cap curl redirects

Security review found no exploitable issue — none of the 3 endpoints
accept user input, so there's no injection surface (upstream URLs are
hardcoded constants, output is XML-escaped). These are defense-in-depth
only: deny direct HTTP access to cache/, and cap CURLOPT_MAXREDIRS to
avoid a hung request on a misbehaving upstream.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

php/common.php

@@ -30,6 +30,7 @@ function http_get(string $url, array $extraHeaders = []): string
         CURLOPT_HTTPHEADER => array_merge(['Accept: application/json'], $extraHeaders),
         CURLOPT_TIMEOUT => 20,
         CURLOPT_FOLLOWLOCATION => true,
+        CURLOPT_MAXREDIRS => 3,
     ]);
     $body = curl_exec($ch);
     $errno = curl_errno($ch);