[pitill0]

Summary

Closes #313.

Improve remote collection URL validation and prevent browser or intermediary caching of private Web API responses.

Changes

• Reject unsupported remote collection URL schemes with HTTP 400 before initiating downloads.
• Preserve HTTP 502 for genuine remote retrieval failures.
• Retain the existing SSRF-protected transport.
• Apply Cache-Control: no-store to private /api/ responses, including authentication and validation errors.
• Preserve the existing cache behavior of public API endpoints and static resources.
• Add regression tests and update the changelog.

Validation

• 1,901 passed, 8 skipped.
• Ruff lint and formatting passed.
• Mypy passed.
• Python compilation passed.
• JavaScript syntax check passed.
• Bandit reported no findings.
• git diff --check passed.

The local dependency audit findings have been investigated separately; the remote CI dependency audit remains the release gate.

Deployment

No production changes have been made. The changes will take effect with a subsequent FluxTuner deployment.