Add official source edition probes

backend/README.md

@@ -1443,3 +1443,29 @@ docker exec geointel python /app/scripts/audit_source_freshness.py \
 
 Use `--fail-on due` to make a planned review date fail automation, or
 `--fail-on never` for reporting only. The command never starts a refresh.
+
+An operator can explicitly add the official GRB and orthophoto edition check:
+
+```bash
+docker exec geointel python /app/scripts/audit_source_freshness.py \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --api-url http://127.0.0.1/api/v1 \
+  --probe-catalogs \
+  --output /app/storage/operator-evidence/source-freshness/with-catalogs.json
+```
+
+Use `--refresh-catalogs` to bypass the 15-minute in-memory cache and
+`--fail-on-catalog` only when temporary official-provider unavailability must
+fail an operator job. This path reads bounded WFS/WMS capabilities and their
+fixed ISO 19139 metadata records. It confirms GRB `GBG`, `WBN`, `WGO`, `ADP`
+and orthophoto `Ortho`, `Vliegdagcontour`; it never requests feature or raster
+content. The public Datavindplaats API requires an access token, so release
+evidence comes from the public metadata links published by the official OGC
+services rather than HTML scraping.
+
+Runtime controls are `SOURCE_CATALOG_PROBE_ENABLED`,
+`SOURCE_CATALOG_GRB_WFS_URL`, `SOURCE_CATALOG_PROBE_TIMEOUT_SECONDS`,
+`SOURCE_CATALOG_PROBE_MAX_RESPONSE_MB` and
+`SOURCE_CATALOG_PROBE_CACHE_TTL_SECONDS`. Metadata links remain restricted to
+the official HTTPS CSW path on `metadata.vlaanderen.be` even when an operator
+overrides the capabilities endpoint.