[Medformatik]

What changed and why

Stacked on #685, whose core helper it reuses; the diff against #685's branch is this one commit.

An operator can point OpenMapX at a hosted Overpass with OVERPASS_URL, including one that needs a login (https://user:pass@host). Every query to such an instance failed. Node's fetch refuses a URL that carries credentials, throwing Request cannot be constructed from a URL that includes credentials: https://user:pass@host/…, so the password also ended up in the error.

The Overpass client now sends such credentials as a Basic Authorization header and queries the URL without them, through the same urlCredentialsAsBasicAuth helper the health checks use since #685. Attribution keeps resolving from the host, now taken from the URL without credentials. Instances without credentials are unaffected.

Verification

• Query test: a query to an OVERPASS_URL with credentials goes to https://overpass.example.org/api/interpreter with Authorization: Basic … for those credentials. The existing Overpass client tests still pass, including the public-mirror fallback.
• Node behaviour: I confirmed that fetch("https://u:p@example.com") throws the error quoted above.
• Repository checks: pnpm lint, pnpm check-types and pnpm check:policy pass. The full Vitest suite passes (1,953 files, 24,087 tests) except motis-probe.test.ts's socket-retry test. That test is flaky: it failed 1 of 5 isolated reruns on this same code, and it drives a real socket through node:http in the data manager, which this change doesn't touch.
• Not run: a query against a real credential-protected Overpass instance; none is configured anywhere I can reach.

Release and upgrade impact

Product impact: ordinary

No package release: the change is limited to the Overpass client in the private @openmapx/core package; neither published package's source changes in this commit.