fix: validate catalog sources and label unchecked links

Description

The pitch.

## Summary

Preserve the useful current-catalog requirements from #130 by @nonggde and the review by @dhve, without adding another automatic remote probe.

- Share the existing HTTP(S) source-syntax validator between the form action and JSON API.
- Reject invalid hosted-link/GitHub source URLs with HTTP 400 before persistence.
- Render `reachable: null` as **link not checked**, separately from true and false.
- Keep pasted submissions unchanged and API submissions unprobed.
- Add 36 runnable catalog boundary tests, pinned development-only Vitest, and a Node 22 CI job for tests and typechecking. Existing locked dependency versions are unchanged.

## Scope

This partially supersedes #130; it does not merge the legacy implementation wholesale. URL syntax is not fetch authorization, capability proof or endorsement. The form's existing best-effort probe is unchanged. Isolated bounded probing, redirect/address policy, timestamps and richer observation states remain separate work. No database schema, duplicate-submission policy, Python evaluator or evidence format changes.

## Verification

- Before the correction: 10 expected failures, 26 passing tests.
- Afterward: **36 catalog tests passed**; shared-guard mutation caught by 8 tests.
- Real route/action and rendered-page code are exercised; external persistence, request/cache context and fetch responses are test doubles. This is not a database or browser-hydration guarantee.
- `npm run typecheck` and ESLint on all changed TS/TSX/config files passed.
- `npm run build -- --webpack` passed on the final restored candidate.
- Built Next server on localhost: invalid `url` and `github` submissions each returned HTTP 400 without reaching persistence/probing; server stopped afterward.
- Full current Town Python suite: **385 passed**, 8 existing warnings.
- Full dashboard lint baseline has 12 pre-existing errors in untouched form/visualizer/navbar code. Local Node 26 emits an upstream loader deprecation; Next also warns about an ancestor lockfile. Neither is represented as fixed.
- Implementation review is local self-review, not an independent review.

Source #130 stays open until this selected replacement has landed; its remaining scope and contributor credit will be recorded in the closing comment.