Pin HTTP/range COG byte-budget contract (#2293) (#2298)

* Pin HTTP/range COG byte-budget contract (#2293)

Add test_http_cog_range_contract_2286.py to lock down the HTTP COG
reader's transport behaviour with explicit byte-count and
range-count assertions. Tests only; no production code changes.

Coverage rows:

* Windowed tile and multi-tile reads fetch only intersecting tiles
  (no read_all fallback; total bytes below file size and bounded by
  the windowed footprint).
* Overview reads pull the overview IFD's tiles, not the full-res
  pixel data.
* band= on multi-band chunky COGs returns correct pixels with
  bounded reads, alone and combined with window=.
* Dask graphs parse IFDs once across all chunk tasks (O(1) header
  GETs in chunk count).
* Truncated buffers, malformed IFD chains, and short pixel bodies
  close the HTTP source via the try/finally guard and raise a
  clear exception rather than hanging.
* coalesce_ranges respects the configured and default
  max-merged-range caps; split_coalesced_bytes round-trips bytes
  under the cap.

Closes #2293.

* Address self-review nits on #2293

Drop unused _parse_cog_http_meta import (flagged by pyflakes), drop
the unused _serve helper that the two loopback tests bypassed inline,
update stale docstrings/comments left over from the 64x64 -> 256x256
fixture resize, and rename unused `expected` unpacks to `_expected`.

No assertion changes; all 15 tests still pass.

Author: brendancol