fix: validate load target cda

[krowvin]

Summary

• validate load target CDA URLs before load commands proceed
• probe the generated OpenAPI document when available
• fall back to the CDA landing page for local builds that expose the UI without the generated spec route
• use a 2.5 second probe timeout
• add --skip-target-cda-check and CWMS_CLI_SKIP_TARGET_CDA_CHECK for cases where the preflight should be bypassed
• add regression coverage for valid CDA, non-CDA, invalid URL, request failure, flag bypass, and env-var bypass cases

Why

Load dry-runs and copy operations should fail early when --target-cda points somewhere that is not a CDA instance. This prevents users from validating or starting a load command against the wrong service, while still giving operators a bypass for unusual local or network conditions.

Validation

• poetry run pytest tests/load/test_cda_target_validation.py tests/commands/test_load_location_ids.py tests/commands/test_load_location_ids_bygroup.py tests/load/test_timeseries_data.py -q
• poetry run pytest -q
• poetry check (warnings only for existing Poetry metadata deprecations)
• CLI negative check against local non-CDA service
• CLI positive check against a local CDA-like landing page