Merge origin/main into german/navara

Conflict resolutions:
- src/main.js: upstream's PHOTON_URL place-search setting is read once at
  module level and passed as geospatial: { endpoints: { photon } } by
  createApplication(), so every engine start of the switch flow gets it; the
  old single top-level createStandaloneApplication() call stays removed.
- src/layers/bikeshare/render/cesium/rendering.js: upstream's
  publishedCapacity fix applied with this branch's
  resolveCapacity(model, capacity, status) signature. The same fix is ported
  to src/layers/bikeshare/render/navara.js (record.publishedCapacity, status
  polls resolve from it), with a Navara regression test; upstream's
  proxyRoute test imports the moved render/cesium/rendering.js.
- src/layers/traffic/flow.js: upstream's nextTask() yield and current()
  check kept before the scene is taken from this branch's
  _trafficScene?.() ?? _viewer?.scene with its missing-scene return.
- scripts/package-boundaries.json, scripts/format-scope.json: union of both
  sides' file lists.
- src/voice/actionSchemas.test.mjs: both history comments kept, payload hash
  recomputed for the merged schemas (Sentinel-2 map stack enum plus the
  shorter layer alias hint).
- src/hudAltitudeDatum.test.mjs: this branch's engine-based IntelHUD
  construction with upstream's placeLabels summary context.

build/vite.js

@@ -28,6 +28,32 @@ export function escapeFsDenyPath(path) {
 
 const REPO_ROOT_GLOB = escapeFsDenyPath(REPO_ROOT);
 
+/**
+ * Browser-safe form of the optional Photon endpoint build input. Only https
+ * is accepted: the page's connect-src allows no plain-http origin, so an
+ * http endpoint would only fail later, silently, in the browser.
+ */
+function photonEndpointSetting(value) {
+  if (value === undefined) return undefined;
+  const text = String(value ?? '').trim();
+  if (!text || ['off', 'none', 'disabled'].includes(text.toLowerCase()))
+    return null;
+  try {
+    const url = new URL(text);
+    if (
+      url.protocol !== 'https:' ||
+      url.username ||
+      url.password ||
+      url.search ||
+      url.hash
+    )
+      return null;
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Content-Security-Policy for every document the dev/preview server serves.
  * No inline script is permitted, and the only foreign script origins are the
@@ -146,12 +172,14 @@ export function createBrowserViteConfig({
   publicDir,
   googleApiKey,
   cesiumToken,
+  photonUrl,
   mapillaryToken,
   host = 'localhost',
   port = 4173,
   allowedHosts = DEFAULT_ALLOWED_HOSTS,
   command,
 } = {}) {
+  const photonSetting = photonEndpointSetting(photonUrl);
   return {
     plugins: [
       // First, so every API response, including a Host refusal, carries them.
@@ -234,6 +262,12 @@ export function createBrowserViteConfig({
       __INTLIFY_DROP_MESSAGE_COMPILER__: 'true',
       'import.meta.env.GOOGLE_MAPS_API_KEY': JSON.stringify(googleApiKey),
       'import.meta.env.CESIUM_ION_TOKEN': JSON.stringify(cesiumToken),
+      // Only expose a validated URL or the explicit disabled sentinel.
+      ...(photonSetting === undefined
+        ? {}
+        : {
+            'import.meta.env.PHOTON_URL': JSON.stringify(photonSetting),
+          }),
       // Mapillary client tokens are public by design (see SECURITY.md).
       'import.meta.env.MAPILLARY_CLIENT_TOKEN': JSON.stringify(
         mapillaryToken ?? '',