Allow active TLE group, admit proxied same-origin requests, keep longest cooldown

- CelesTrak allowlist includes `active`, which Space Missions'
  getActiveTle() requests; unknown groups still answer 400.
- The CelesTrak gate uses admitSameSiteKeyless so the documented reverse
  proxy keeps working while foreign/opaque Origins and cross-site
  Sec-Fetch-Site are still refused with 403.
- A provider failure never shortens an existing cooldown (CelesTrak and
  Launch Library keep the later deadline).
- Tests: real getActiveTle() through the middleware, proxied app request
  vs unrelated Origin, concurrent failures finishing in both orders.
- docs/CURRENT-STATE.md: eight groups, keyless gate, non-shortening cooldown.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/providers/space/celestrak.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { promises as fsp } from 'node:fs';
 import { celestrakTleUrl } from '../../../src/data/spaceProviderRequests.js';
 import { providerCooldownMs } from './cooldown.js';
-import { admitSameSite } from '../common/same-site.js';
+import { admitSameSiteKeyless } from '../common/same-site.js';
 import { readResponseTextCapped } from '../common/http.js';
 
 /**
@@ -34,6 +34,8 @@ export function celestrakProxy() {
     'galileo',
     'geo',
     'starlink',
+    // Space Missions (`getActiveTle`) reads the full active catalog.
+    'active',
   ]);
   let cooldownUntil = 0;
   const mem = new Map(); // group -> { at: epochMs, body: string }
@@ -77,7 +79,12 @@ export function celestrakProxy() {
       },
     });
     if (!res.ok) {
-      cooldownUntil = Date.now() + providerCooldownMs(res);
+      // Group refreshes run in parallel: a later failure without Retry-After
+      // must never shorten a longer deadline an earlier one already set.
+      cooldownUntil = Math.max(
+        cooldownUntil,
+        Date.now() + providerCooldownMs(res),
+      );
       void res.body?.cancel().catch(() => {});
       throw new Error(`HTTP ${res.status}`);
     }
@@ -96,7 +103,9 @@ export function celestrakProxy() {
       const group = String(req.url || '')
         .replace(/^\//, '')
         .split('?')[0];
-      if (admitSameSite(req, res)) return;
+      // Keyless and needed to render the satellites layer: refuse cross-site
+      // browsers but keep the documented reverse-proxy deployment working.
+      if (admitSameSiteKeyless(req, res)) return;
       if (req.method !== 'GET') {
         res.writeHead(405);
         res.end();

server/providers/space/launch-library.js

@@ -90,8 +90,12 @@ export function rocketLaunchesProxy() {
       headers: launchLibraryRequestHeaders(),
     });
     if (!upstream.ok) {
-      cooldownUntil = Date.now() + providerCooldownMs(upstream);
-      cooldownStatus = upstream.status;
+      const deadline = Date.now() + providerCooldownMs(upstream);
+      // Never shorten a longer cooldown that is already in force.
+      if (deadline >= cooldownUntil) {
+        cooldownUntil = deadline;
+        cooldownStatus = upstream.status;
+      }
       void upstream.body?.cancel().catch(() => {});
       const error = new Error(`upstream HTTP ${upstream.status}`);
       error.upstreamStatus = upstream.status;