Show T5 products in the client's shop; keep float IDs and unknown paths off IMVU

The shop's T5 filter (maturity_rating "t5") is answered from the hub's products, fetched so they can be
shown and tried on; buying T5 products adds them to the hub library, and product.php details for
community products are answered here.

The client sends some product IDs as floats ("2000000008.0"): product.php passed the worn community
product to IMVU that way. Every ID is now read either way, and products.Guard refuses any request to
IMVU that still names a local ID given out. T5DE_PROXY_DUMP logs request and response bodies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

internal/products/guard_test.go

@@ -0,0 +1,32 @@
+package products
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"testing"
+
+	"git.t5de.dev/t5de/t5de-proxy/internal/proxy"
+)
+
+func TestGuard(t *testing.T) {
+	h, _ := newHarness(t)
+	local := h.p.byProductID("blue-coat").local
+	g := Guard{Products: h.p}
+	check := func(rawURL, body string, refused bool) {
+		t.Helper()
+		u, _ := url.Parse(rawURL)
+		req, _ := http.NewRequest("POST", rawURL, nil)
+		x := &proxy.Exchange{URL: u, Request: req, Body: []byte(body)}
+		g.Intercept(x)
+		if (x.Response != nil) != refused {
+			t.Errorf("%s %s: refused %v", rawURL, body, x.Response != nil)
+		}
+	}
+	check("https://client-dynamic.imvu.com/api/new.php", fmt.Sprintf(`{"pids": [80, %d.0]}`, local), true)
+	check(fmt.Sprintf("https://api.imvu.com/product/product-%d", local), "", true)
+	check(fmt.Sprintf("https://client-dynamic.imvu.com/api/x.php?ids=1%%2C%d", local), "", true)
+	check("https://client-dynamic.imvu.com/api/new.php", `{"pids": [80, 2000000777]}`, false) // not given out
+	check("https://client-dynamic.imvu.com/api/new.php", fmt.Sprintf(`{"n": "1%d"}`, local), false)
+	check(fmt.Sprintf("https://hub.example/%d", local), "", false) // only IMVU's hosts
+}