fix(sources): clean URL-shaped fragments; one registry for busy sources

- A fragment is cleaned whatever its shape: `#https://joe:pw@…` loses its
  userinfo, an unclassifiable secret is dropped, and the name check reads
  a URL in the fragment as well as a parameter list.
- Every refresh holds its source in the root SourceActivityService, which
  deletes and the startup auto-refresh already use: Sources-row refreshes,
  the switcher's M3U refresh and the shared Xtream flow. The switcher no
  longer offers Refresh or Remove for a source the page is refreshing, the
  removal service ignores a held source, a second refresh from either
  entry point is skipped, and the page disables Remove while it is held.
- The long-input timing spec allows 3 s: the inputs take about 0.25 s,
  a backtracking pattern takes minutes, and a loaded runner took 1.6 s.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture/iptvnator-ui-guidelines.md

@@ -1391,10 +1391,11 @@ in `@iptvnator/playlist/shared/util` (`source-display`, `source-format`,
   switcher closes the popover first, since its focus trap would keep the
   keyboard from Undo: Undo takes the focus and returns it to the trigger
   (`SourceRemovalOptions.returnFocusTo`). A source cannot be removed while
-  a refresh clears and refills it: Remove is disabled in both lists and the
-  service ignores it (`PlaylistRefreshActionService.isSourceBusy`), and the
-  Sources page shows a switcher refresh as busy. Bulk cleanup keeps its
-  confirmation dialog.
+  a refresh clears and refills it: every refresh (a Sources row, the
+  switcher, the Xtream flow, the startup auto-refresh) and every delete
+  holds the source in the root `SourceActivityService`, which both lists,
+  the removal service and a second refresh consult. The Sources page shows
+  a switcher refresh as busy. Bulk cleanup keeps its confirmation dialog.
 - **Side list.** Type and, on desktop, Status (Any / Responding / Not
   responding) combine and persist (`SourcesViewStateService`); each group
   counts within the other's choice. The page checks every source, not only