feat(street-level): Panoramax as a fourth, keyless imagery provider

Panoramax, the open federated street-level commons, registers beside
Mapillary, Google Street View and KartaView. Its meta-catalogue
(api.panoramax.xyz) is keyless and CORS-open, so it runs in the browser:

- coverage from its vector tiles: sequence lines at z11–14 below 30 km
  (longest first under the per-tile cap), and above that the grid layer's
  density cells as binned points, not counted as sequences;
- a click on a line opens that sequence's picture nearest the click
  (STAC search, any direction), without moving the camera, then any
  sequence's if it has none within 50 m; the 360° and since filters go to
  the lines and to the API;
- cones from the z15 tiles' pictures layer around the open picture
  (~110 bytes a picture, against ~7.5 kB for a STAC item), re-centred when
  a picture opens outside them; ‹ › follow the picture's prev/next links;
- the caption names the author (not an account named by an email
  address) and the picture's licence (StreetPose `license`), and links to
  the picture in the Panoramax viewer; the globe credits Panoramax.

KartaView's viewer becomes the shared photoViewer.js (flat <img>, 360° on
panorama.js, ‹ ›, keyboard, pinch, context loss), driven by a per-provider
PhotoSources table; the request limiter moves to limiter.js. Panoramax shows
the 2,048 px SD derivative and fetches the HD original only when the viewer
is wide enough, once, shrunk while it decodes (never above 8,192 px).

Orange #ff6f00 (Panoramax's own), off by default, share option
0.m.0_0.r.panoramax-1. The MCP panel allows the meta-catalogue and the
biggest instances. Tests: policy, decode, source, viewer, provider, and a
Panoramax fixture in the hermetic browser gate.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/tooling/streetLevelQa.test.mjs

@@ -743,3 +743,97 @@ test('KartaView fixtures draw the drive, answer nearest first, and refuse the st
     'GET api.kartaview.org/2.0/photo/{id}',
   );
 });
+
+test('Panoramax fixtures: two sequences on one street, searches honour sequence and filters, unknown calls are flagged', async () => {
+  const {
+    answerPanoramaxRequest,
+    describePanoramaxCall,
+    PNX_LINE,
+    PNX_SEQUENCES,
+    panoramaxHdDownloads,
+    panoramaxPictures,
+    panoramaxTile,
+    resetPanoramaxFixture,
+  } = await import('../../scripts/fixtures/street-level/panoramax.mjs');
+  const { decodeCoverageTile, decodePictures } = await import(
+    '../layers/streetLevel/providers/panoramax/decode.js'
+  );
+  const { normalizeItem } = await import(
+    '../layers/streetLevel/providers/panoramax/policy.js'
+  );
+  resetPanoramaxFixture();
+  const pictures = panoramaxPictures();
+  assert.deepEqual(
+    [...new Set(pictures.map((p) => p.sequenceId))],
+    [...PNX_SEQUENCES],
+  );
+  assert.ok(pictures.some((p) => p.isPano));
+  // Coverage: both lines in a z14 tile on the street; cones in z15.
+  const z = 14;
+  const x = lonToTileX((PNX_LINE.west + PNX_LINE.east) / 2, z);
+  const y = latToTileY(PNX_LINE.lat, z);
+  const lines = decodeCoverageTile(panoramaxTile(z, x, y), { x, y, z });
+  assert.deepEqual(
+    lines.sequences.map((s) => s.id).sort(),
+    [...PNX_SEQUENCES].sort(),
+  );
+  const t15 = {
+    x: lonToTileX(pictures[20].lon, 15),
+    y: latToTileY(PNX_LINE.lat, 15),
+    z: 15,
+  };
+  assert.ok(
+    decodePictures(panoramaxTile(15, t15.x, t15.y), t15, PNX_SEQUENCES[0])
+      .length > 0,
+  );
+  // A search for one sequence near the street gives only its pictures, nearest first.
+  const at = pictures[30];
+  const ask = (query) =>
+    JSON.parse(
+      answerPanoramaxRequest({
+        method: 'GET',
+        url: `https://api.panoramax.xyz/api/search?${query}`,
+      }).body,
+    ).features.map(normalizeItem);
+  const own = ask(
+    `place_position=${at.lon},${at.lat}&place_distance=0-50&limit=5&collections=${PNX_SEQUENCES[1]}`,
+  );
+  assert.ok(own.length > 0);
+  assert.ok(own.every((p) => p.sequenceId === PNX_SEQUENCES[1]));
+  assert.equal(own[0].nextId && typeof own[0].nextId, 'string');
+  const panos = ask(
+    `place_position=${at.lon},${at.lat}&place_distance=0-200&limit=50&filter=field_of_view%3D360`,
+  );
+  assert.ok(panos.length > 0 && panos.every((p) => p.isPano));
+  assert.deepEqual(
+    ask(
+      `place_position=${at.lon},${at.lat}&place_distance=0-200&limit=50&datetime=2024-01-01T00:00:00.000Z/..`,
+    ).every((p) => p.sequenceId === PNX_SEQUENCES[0]),
+    true,
+    'the second sequence is older',
+  );
+  const one = ask(`ids=${at.id}&limit=1`);
+  assert.equal(one[0].id, at.id);
+  // Its pictures, and only those, are served; HD downloads are counted.
+  const file = (name) =>
+    answerPanoramaxRequest({
+      method: 'GET',
+      url: `https://panoramax.openstreetmap.fr/derivates/${name}`,
+    });
+  assert.equal(file(`${at.id}/sd.jpg`).status, 200);
+  assert.equal(file(`${at.id}/hd.jpg`).status, 200);
+  assert.equal(panoramaxHdDownloads(), 1);
+  assert.equal(file('nope/sd.jpg').known, false);
+  const unknown = answerPanoramaxRequest({
+    method: 'GET',
+    url: 'https://api.panoramax.xyz/api/collections/x/items',
+  });
+  assert.equal(unknown.known, false);
+  assert.equal(
+    describePanoramaxCall(
+      'GET',
+      new URL('https://api.panoramax.xyz/api/map/14/1/2.mvt'),
+    ),
+    'GET api.panoramax.xyz/api/map/{z}/{x}/{y}.mvt',
+  );
+});