Fix broken-playback providers (wowxxx, porndish, noodlemagazine) and a shared 429 retry bug

- wowxxx: site migrated wow.xxx -> wowxxx.to; update BASE_URL and stop
  pinning Version::HTTP_11, which mismatched the TLS handshake's h2 ALPN
  and got scored as a bot (same root cause already fixed for jable.tv)
- porndish: recognize playmogo.com iframes as the same Doodstream-clone
  embed protocol as myvidplay.com (confirmed live) instead of falling
  through to a naive branch that pointed formats[0] at the unresolved,
  Cloudflare-protected iframe URL; kept in sync in both providers/porndish.rs
  and proxies/porndish.rs since single-provider builds can't share code
  across that boundary
- noodlemagazine: entity-decode the thumb URL pulled from a raw
  data-original="..." attribute - undecoded `&` in the query string
  was getting the CDN to 400 the request
- requester.rs: cap the previously-unbounded HTTP 429 retry loop at 3
  attempts before falling through to the existing Jina/FlareSolverr
  fallback, instead of retrying forever with no bound

Also fixes check.py: the thumbnail check never consulted the
CF-protected-host allowlist (only the page-url check did), and adds
missav.ws/surrit.com, tik.porn/image-cdn.tik.porn, vrporn.com, and
www.wowxxx.to/img.wowxxx.to to that allowlist - all four providers
already work fine through the app's real client; the checker's plain
probes (and its yt-dlp invocation, which never applies a channel's
declared ytdlpCommand impersonation flag) just can't replicate that.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTqf6orbHZ9rFFpVpcgzcR

src/util/requester.rs

@@ -644,6 +644,13 @@ impl Requester {
         let jina_handle = tokio::spawn(async move {
             Self::fetch_jina_mirror_body(cookie_jar, user_agent, proxy_enabled, &url_owned).await
         });
+        // A persistent 429 (e.g. a site's IP-level rate limit kicking in) used
+        // to retry forever with no cap and no fallback, hanging until an
+        // unrelated caller-side timeout cut it off. Cap the retries and fall
+        // through to the same Jina/FlareSolverr fallback every other failure
+        // status uses once they're exhausted.
+        const MAX_RATE_LIMIT_RETRIES: u8 = 3;
+        let mut rate_limit_retries: u8 = 0;
         loop {
             let mut request = self.client.get(url);
             if let Some(version) = _http_version {
@@ -749,11 +756,14 @@ impl Requester {
                 jina_handle.abort();
                 return Ok(body);
             }
-            if response.status().as_u16() == 429 {
+            if response.status().as_u16() == 429 && rate_limit_retries < MAX_RATE_LIMIT_RETRIES {
+                rate_limit_retries += 1;
                 crate::flow_debug!(
-                    "trace={} requester direct retry url={} status=429",
+                    "trace={} requester direct retry url={} status=429 attempt={}/{}",
                     self.debug_trace_id().unwrap_or("none"),
-                    crate::util::flow_debug::preview(url, 120)
+                    crate::util::flow_debug::preview(url, 120),
+                    rate_limit_retries,
+                    MAX_RATE_LIMIT_RETRIES
                 );
                 tokio::time::sleep(std::time::Duration::from_secs(1)).await;
                 continue;