fix(go2rtc): sanitize RTSP source fragments and honor #noaudio (#429)

[matteius]

What

When an operator appends a fragment to a camera URL, go2rtc's RTSP source
parses it with strings.Cut(rawURL, "#") + ParseQuery
(go2rtc/internal/rtsp/rtsp.go:96) and only acts on a fixed key set:
transport, timeout, backchannel, media, pkt_size, log_level, source, mp4.
Anything else — most commonly #noaudio — is silently swallowed: it errors on
nothing and does nothing, but stays in the stored source. And LightNVR ignored
the #noaudio intent entirely and still injected ffmpeg:<id>#audio=aac#audio=opus.

This sanitizes the fragment of native rtsp:// sources in
go2rtc_stream_register() before we append our own params:

• drop unsupported tokens (with a log_warn, so it isn't silent), keeping only
  the keys go2rtc actually honors;
• promote #noaudio/#no-audio into a real suppression of the audio producer.

Non-RTSP sources (ffmpeg:, wyze://, onvif://, http://) are untouched.

Why

Part of #429. It gives operators a working per-stream lever to turn the audio
pipeline off, which also serves as a clean isolation test for the remaining
WebRTC-audio investigation on that issue (does video come back when the audio
producer is gone?).

Test

• New go2rtc_sanitize_rtsp_fragments() verified against the relevant cases:
  #noaudio, #noaudio#transport=tcp#timeout=30, #transport=tcp,
  #foo=bar#noaudio#media=video, no-fragment, #no-audio — supported keys
  preserved, #noaudio suppresses audio, unknown tokens dropped.
• cmake --build of lightnvr is green.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR improves LightNVR’s go2rtc stream registration for native rtsp:// / rtsps:// sources by sanitizing #fragment tokens before LightNVR appends its own go2rtc RTSP options, and by honoring operator intent flags like #noaudio to suppress LightNVR’s injected ffmpeg audio producer.

Changes:

• Added an allowlist-based sanitizer for RTSP URL fragment tokens, dropping unknown tokens (with warnings) before appending LightNVR’s own #transport=... / #timeout=... params.
• Recognizes #noaudio / #no-audio and suppresses injection of the ffmpeg:<id>#audio=... producer when present.
• Leaves non-RTSP schemes untouched.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.