Describe the bug

open_geotiff(url, window=..., band=...) passes both parameters through to read_to_array, but the HTTP branch at xrspatial/geotiff/_reader.py:1885 calls _read_cog_http(source, overview_level=..., band=..., max_pixels=...) and drops window on the floor. _read_cog_http then hardcodes window=None when calling _fetch_decode_cog_http_tiles at line 1594. The function accepts band but never slices on it.

Three concrete parity gaps with the local eager path:

1. window never reaches the HTTP fetch. The HTTP path returns the full raster while open_geotiff at __init__.py:645-657 builds window-sized coords. The result is either a shape mismatch on xarray construction or wrong coords assigned to a full array.

2. band is accepted but unused on the HTTP path. The local path slices arr[:, :, band] at _reader.py:1963-1964 for multi-band arrays. HTTP returns every band.

3. PlanarConfiguration=2 is not handled on HTTP. The local tile reader iterates over per-band tile groups when planar == 2 (_reader.py:1437-1438). The HTTP tile-index loop computes tile_idx = tr * tiles_across + tc with no per-band offset, so separate-band COGs fetch the wrong byte ranges and decode with the wrong expected byte count.

Reproduction

```python
from xrspatial.geotiff import open_geotiff
da = open_geotiff("http://example.com/tiled.tif", window=(0, 0, 256, 256))

Returns full-image data, but coords are sized to the window.

```

Expected behavior

read_to_array(url, window=W, band=B) returns the same shape and values as read_to_array(local_path, window=W, band=B) for the same source.

Suggested fix

• Thread window through _read_cog_http to _fetch_decode_cog_http_tiles (the helper already accepts it).
• Apply band after the array is materialised, matching the local path.
• Add per-band tile indexing in the HTTP loop when planar == 2, mirroring the local band_count logic.

Add parity tests that read the same COG from disk and from a local HTTP server (e.g. pytest-httpserver) and compare shape and contents for window-only, band-only, window+band, and planar=2 cases.

Additional context

Reported during a code review of the geotiff module against the recent SSRF and typed-error hardening work (#1664, #1662, #1661).