fix(street-level): modal viewer, pinned redirects, real-route CI checks

From the IC8 review of #768, each with tests that fail before:

- P2: the expanded viewer is a real modal: while it is on screen every
  other <body> child is inert (only the ones it set are restored, on
  shrink, close and destroy, and when Clean View/recording/cockpit hide
  it). The voice pill and toasts are not clickable while it is expanded.
- P2: the tile proxy follows redirects by hand, at most 3 hops, each one
  HTTPS on exactly https://tiles.mapillary.com without credentials;
  anything else is a 502 and the token never leaves that origin.
- P2: the real dev and preview server smoke tests request
  /api/mapillary/status and a tile, and the browser gate first checks the
  server's real status route before any interception, so CI fails if the
  Mapillary plugin is not registered.
- P2: both gates press panel headers through one shared helper
  (scripts/qa-panelDrag.mjs): re-resolve the header until it is under the
  pointer, record what the press hit, wait on the real floating/docked
  state, and retry only a press that provably missed the header.

Verified: unit 5910 pass; fixture gate 17/17; panel gate 5/5; live gate
with a real Mapillary token 22/22.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/format-scope.json

@@ -37,6 +37,7 @@
   "docs/APPLICATION.md",
   "scripts/qa-application.mjs",
   "scripts/qa-panel-resize.mjs",
+  "scripts/qa-panelDrag.mjs",
   "src/tooling/panelResizeQa.test.mjs",
   "scripts/qa-terrain-429.mjs",
   "src/app/application.js",
@@ -915,6 +916,7 @@
   "src/layers/streetLevel/cameraFollow.test.mjs",
   "src/ui/streetLevelControls.test.mjs",
   "src/ui/panelDock.test.mjs",
+  "src/layers/streetLevel/marker.test.mjs",
   "src/layers/streetLevel/viewerHost.test.mjs",
   "src/layers/streetLevel/providers/mapillary/sequences.test.mjs",
   "src/layers/streetLevel/selection.test.mjs",