fix(security): guard EPG XML importer against oversized text nodes

[Bladestar2105]

Motivation

• The streaming EPG importer parsed untrusted provider XML and accumulated text for display-name, title, and desc without any per-node size limit, enabling a remote provider to cause unbounded memory growth and a DoS.

Description

• Add a per-node text-size cap MAX_XML_TEXT_NODE_LENGTH = 50 * 1024 to the streaming parser in src/services/epgService.js.
• Enforce the cap in the shared appendText handler and abort the import by rejecting the parser promise, calling stream.destroy(), and closing the parser when the limit is exceeded.
• This change bounds text accumulation for display-name, title, and desc while preserving the existing GZIP handling, streaming node-xml-stream flow, and batch DB insertion logic.

Testing

• Ran npm run lint, which completed successfully and reported only pre-existing warnings.
• Ran npm test -- epgService, which found no matching tests in the repository.
• Ran npm run build, which completed successfully.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 73b804f7ed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Apply text-size cap only to tracked XML node content

The new guard runs before checking whether we are inside display-name, title, or desc, so it uses stale currentText from a previous tracked node when handling later text events. This causes false rejections: a title just under 50KB can still fail when a subsequent non-tracked text node (for example <category>) is parsed, because the condition compares that new text against the previous node’s accumulated length. Move the size check inside the same branches that append to currentText (or reset currentText on every text-bearing tag) so the cap is truly per-node.

Useful? React with 👍 / 👎.