build(deps): upgrade got to 15 (with type migration)

[matthewhanson]

Summary

Replaces dependabot #1125 (got 13→15), which failed typecheck — got 15 has breaking type/runtime changes that needed code migration.

got 15 changes handled

1. Removed CancelableRequest export → use RequestPromise (in tests/helpers/api.ts).
2. searchParams no longer accepts null → changed { _filter: null } to { _filter: '' } at the 4 searchParams call sites. Verified these serialize identically (_filter=) in got 15, so wire behavior is unchanged. The POST-body case (json: { _filter: null }) keeps null — valid JSON, intended.
3. Auto-decompress now strips content-encoding → the compression test requests with an explicit Accept-Encoding: br and decompress: false so the server's compression is observable.

got is a production dependency (the ingest lambda uses it to fetch remote STAC records by href), so this is a real prod major bump — no API/behavior change to stac-server itself.

Verification

typecheck (both tsconfigs) ✓, lint ✓, unit (69) ✓, system (174) ✓, build ✓.

Closes #1125

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Upgrades the got HTTP client from v13 to v15 and migrates affected TypeScript/test call sites to match the new types and request option constraints, while keeping stac-server’s outward API behavior unchanged.

Changes:

• Bump got dependency to ^15.0.5 (and update lockfile).
• Update typed test API client types to use RequestPromise (replacing removed CancelableRequest).
• Adjust system tests for searchParams nullability and compression observation (disable auto-decompression for the compression assertion).

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/system/test-api-search-get.ts	Replace _filter: null with empty string to satisfy got v15 searchParams typing.
tests/system/test-api-item-get.ts	Same searchParams nullability adjustment for _filter.
tests/system/test-api-get-root.ts	Update compression test to disable decompression and set Accept-Encoding explicitly so content-encoding remains observable.
tests/system/test-api-collection-items-get.ts	Same searchParams nullability adjustment for _filter.
tests/helpers/api.ts	Migrate typed client overload return types from CancelableRequest to RequestPromise.
package.json	Bump got dependency to ^15.0.5.
package-lock.json	Lockfile updates reflecting got v15 and transitive dependency changes.
CHANGELOG.md	Document the dependency upgrade and its intent (no stac-server API/behavior change).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[matthewhanson]

Addressed Copilot's review (123b6a2):

• engines: added "engines": { "node": ">=22" } (got 15 requires Node 22).
• CI Node alignment: pointed docs.yml at .nvmrc instead of hardcoded Node 20, so npm ci runs on Node 22 and won't EBADENGINE on got 15.
• strictContentLength: set strictContentLength: false on the ingest remote-record fetch, so a misconfigured upstream Content-Length can't newly fail ingest under got's stricter defaults. (Note: this is the only got call in production code; the rest are tests.)