fix: sanitize proxy error payloads, loopback dev-cctv, drop doc drift

Four small, independently-verified issues from the audit backlog:

- #262/#263: the celestrak, terrain-heights, adsbdb and launch-library
  proxies put raw `err.message` / raw upstream error bodies into HTTP
  responses, contradicting the sanitized-error property KNOWN-ISSUES.md
  documents. They now log the real error server-side (matching the GBFS
  and CCTV proxy convention) and return a generic message.
- #265: scripts/dev-cctv.sh defaulted to HOST=0.0.0.0 while dev-fresh.sh
  and dev-secure.sh default to loopback. Now loopback, opt in with
  HOST=0.0.0.0.
- #274: naturalEarthRegions.js's internal haversineKm took (lon, lat,
  lon, lat) while every other haversineKm in src/ takes (lat, lon, lat,
  lon). Same name, same signature shape, opposite order — a silent
  wrong-distance landmine. Reordered to match; the one call site was
  updated, so behavior is unchanged.
- #270: removed CCTV_AUTO_CALIBRATE and CCTV_DRAPE_MESH from
  .env.example; no code anywhere reads them.

Not done: deduplicating the ~10 haversine implementations into one
shared utility. That is issue #188's scope and a far larger diff;
removing the argument-order landmine is what makes the current state
safe.

Verified: npm test (2705 pass / 0 fail), npm run build green.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01C3eGYgDYBo2BCUeDGwGvrp

.env.example

@@ -138,5 +138,3 @@ AISSTREAM_API_KEY=
 # CCTV_MAX_SOURCES=48                                  # overall cap on registered cameras
 # CCTV_PREFER_AUSTIN=1                                 # prioritize Austin cameras in the registry
 # CCTV_FORCE_AUSTIN=                                   # force Austin-only sources
-# CCTV_AUTO_CALIBRATE=1                                # auto-calibrate camera projection (client flag)
-# CCTV_DRAPE_MESH=1                                    # drape frames onto 3D geometry (client flag)