feat(flights): show the tracked aircraft's Planespotters photo in Contacts

Tracking a civil flight asks Planespotters for that aircraft's photo, once
per aircraft, straight from the browser. The CONTEXT panel's CONTACTS view
shows it under the flight's name with the photographer's credit, as a plain
link to the photo's page. Only images on plnspttrs.net and pages on
www.planespotters.net are ever shown or linked. Military aircraft and a
converted TR-3B are never looked up.

Flight lookups (type, route, photo) whose source failed temporarily are
asked again after a 60-second cool-down; an answer, found or not, and a
permanent refusal stay final for the session. A route belongs to the
callsign it was looked up for, so a callsign change drops the old route.

Browser QA scripts that track a flight answer the photo lookup themselves,
so they never call the third party.

scripts/package-boundaries.json

@@ -242,6 +242,11 @@
     "modules": ["src/data/adsbLolFallback.js", "src/sources/adsbFields.js"],
     "external": []
   },
+  "planespotters-source": {
+    "exports": ["./sources/planespotters"],
+    "modules": ["src/data/planespottersPhoto.js"],
+    "external": []
+  },
   "place-providers": {
     "runtime": "node",
     "exports": ["./server/providers/places"],
@@ -1395,7 +1400,8 @@
       "src/sources/live/contract.js",
       "src/sources/live/index.js",
       "src/sources/live/standalone.js",
-      "src/sources/live/vessels.js"
+      "src/sources/live/vessels.js",
+      "src/data/planespottersPhoto.js"
     ],
     "external": []
   },
@@ -1462,7 +1468,8 @@
       "src/i18n/locales/zh-Hant.json",
       "src/ui/unitLabels.js",
       "src/time/worldClock.js",
-      "src/time/julian.js"
+      "src/time/julian.js",
+      "src/data/planespottersPhoto.js"
     ],
     "external": ["cesium"]
   },
@@ -3438,7 +3445,8 @@
       "src/layers/satellites/classes.js",
       "src/layers/satellites/sensors.js",
       "src/data/ucsSatellites.js",
-      "src/data/imagingSensors.js"
+      "src/data/imagingSensors.js",
+      "src/data/planespottersPhoto.js"
     ],
     "external": [
       "hls.js",
@@ -4098,7 +4106,8 @@
       "src/layers/satellites/classes.js",
       "src/layers/satellites/sensors.js",
       "src/data/ucsSatellites.js",
-      "src/data/imagingSensors.js"
+      "src/data/imagingSensors.js",
+      "src/data/planespottersPhoto.js"
     ],
     "external": [
       "hls.js",
@@ -5244,7 +5253,8 @@
       "src/layers/satellites/classes.js",
       "src/layers/satellites/sensors.js",
       "src/data/ucsSatellites.js",
-      "src/data/imagingSensors.js"
+      "src/data/imagingSensors.js",
+      "src/data/planespottersPhoto.js"
     ],
     "external": ["@mapbox/vector-tile", "pbf"]
   },

scripts/qa-cockpit-utility.mjs

@@ -4,6 +4,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const shotsDir = path.join(repoRoot, 'qa-shots', 'cockpit-utility');
@@ -29,6 +30,7 @@ const browser = await puppeteer.launch({
   ],
 });
 const page = await browser.newPage();
+await stubPlanespotters(page);
 const failures = [];
 const consoleErrors = [];
 const localHttpErrors = [];
@@ -825,6 +827,7 @@ try {
   // a legitimate retained snapshot cannot satisfy or invalidate a FIRST-fetch
   // assertion when camera motion supersedes the manager's initial update.
   const readinessPage = await browser.newPage();
+  await stubPlanespotters(readinessPage);
   let deferredInstallationReadiness;
   try {
     await readinessPage.setViewport({ width: 1440, height: 900 });

scripts/qa-context-arrivals.mjs

@@ -28,6 +28,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 import { createScreencast, moveCamera } from './qa-journey-recorder.mjs';
 
 const argv = process.argv.slice(2);
@@ -77,6 +78,7 @@ const browser = await puppeteer.launch({
 
 async function openPage({ aircraft = false } = {}) {
   const page = await browser.newPage();
+  await stubPlanespotters(page);
   await page.setViewport({ width: 1440, height: 900 });
   page.on('console', (message) => {
     if (message.type() === 'error') result.consoleErrors.push(message.text());

scripts/qa-emergency-squawk.mjs

@@ -27,6 +27,7 @@
  */
 
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -223,6 +224,7 @@ async function main() {
   const errors = [];
   try {
     const page = await browser.newPage();
+    await stubPlanespotters(page);
     await page.setViewport({ width: 1440, height: 900 });
     page.on('pageerror', (e) => errors.push(e.message));
     const { lon, lat } = CENTER;

scripts/qa-focus-evidence.mjs

@@ -21,6 +21,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 
 const argv = process.argv.slice(2);
 const getOpt = (name, fallback = null) => {
@@ -651,6 +652,7 @@ async function main() {
     ],
   });
   const page = await browser.newPage();
+  await stubPlanespotters(page);
   await page.setViewport(VIEWPORT);
   const consoleMessages = [];
   page.on('console', (message) => {

scripts/qa-heading-b3.mjs

@@ -99,6 +99,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 
 // ---------------------------------------------------------------------------
 // Args (same shape as track-regression.mjs)
@@ -466,6 +467,7 @@ async function main() {
   const failedResponses = [];
   try {
     const page = await browser.newPage();
+    await stubPlanespotters(page);
     await page.setViewport({ width: 1280, height: 800 });
     page.on('console', (msg) => {
       if (msg.type() === 'error') {

scripts/qa-photo-stub.mjs

@@ -0,0 +1,78 @@
+/**
+ * Keep browser QA off third-party aircraft photo services.
+ *
+ * Tracking a civil flight asks Planespotters for the aircraft's photo. QA
+ * runs track synthetic hexes, so a real request only adds a third-party
+ * dependency and, when the service refuses a headless browser, a console
+ * error that fails the "no console errors" checks. Every photo lookup is
+ * answered with no photos instead, without leaving the browser.
+ */
+
+/** Origin of the aircraft photo lookup. */
+export const PLANESPOTTERS_ORIGIN = 'https://api.planespotters.net';
+
+/** The answer every stubbed lookup gets: no photos for this aircraft. */
+export const PLANESPOTTERS_EMPTY_BODY = JSON.stringify({ photos: [] });
+
+/** Whether a URL is a photo lookup the stub answers. */
+export function isPlanespottersRequest(url) {
+  try {
+    return new URL(String(url)).origin === PLANESPOTTERS_ORIGIN;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Answer an intercepted photo lookup from a page that already uses request
+ * interception. Returns false for any other request, which the caller
+ * handles as before.
+ * @param {import('puppeteer').HTTPRequest} request
+ * @returns {boolean} Whether the request was answered.
+ */
+export function respondToPlanespotters(request) {
+  if (!isPlanespottersRequest(request.url())) return false;
+  request.respond({
+    status: 200,
+    contentType: 'application/json',
+    headers: { 'Access-Control-Allow-Origin': '*' },
+    body: PLANESPOTTERS_EMPTY_BODY,
+  });
+  return true;
+}
+
+/**
+ * Stub photo lookups in a page that does not intercept requests: wraps
+ * `fetch` before any app code runs, so a lookup never reaches the network.
+ * Composes with other `fetch` shims in either order.
+ * @param {import('puppeteer').Page} page
+ * @returns {Promise<void>}
+ */
+export async function stubPlanespotters(page) {
+  await page.evaluateOnNewDocument(
+    (origin, body) => {
+      const original = window.fetch.bind(window);
+      window.fetch = (input, init) => {
+        const href =
+          typeof input === 'string' ? input : input?.url || String(input);
+        let target = '';
+        try {
+          target = new URL(href, location.href).origin;
+        } catch {
+          /* not a URL */
+        }
+        if (target === origin) {
+          return Promise.resolve(
+            new Response(body, {
+              status: 200,
+              headers: { 'Content-Type': 'application/json' },
+            }),
+          );
+        }
+        return original(input, init);
+      };
+    },
+    PLANESPOTTERS_ORIGIN,
+    PLANESPOTTERS_EMPTY_BODY,
+  );
+}

scripts/qa-sprites-b5.mjs

@@ -32,6 +32,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 import { classifyAircraft, CLASS_SCALE_2D, CLASS_SCALE_3D, CLASS_MODEL_REAL } from '../src/data/aircraftClass.js';
 // Hangar fleet (2026-08-16): real per-class GLBs render at scale 1; military
 // heavies (airliner/quadjet/glider) render airplane.glb at 1 x class; only
@@ -186,6 +187,7 @@ async function main() {
   const httpErrors = [];
   try {
     const page = await browser.newPage();
+    await stubPlanespotters(page);
     await page.setViewport({ width: 1280, height: 800 });
     page.on('console', (msg) => {
       if (msg.type() === 'error') {

scripts/track-regression.mjs

@@ -94,6 +94,7 @@
 
 import fs from 'node:fs';
 import puppeteer from 'puppeteer';
+import { respondToPlanespotters } from './qa-photo-stub.mjs';
 import { arrivalAngleViolated, arrivalRotationPassed } from '../src/tooling/trackArrivalObservation.mjs';
 import { classifyAircraft, CLASS_SCALE_3D, CLASS_MODEL_REAL } from '../src/data/aircraftClass.js';
 import { ensureGeoidReady, geoidHeight } from '../src/data/geoid.js';
@@ -287,6 +288,8 @@ async function main() {
         });
         return;
       }
+      // Aircraft photo lookups never reach the third party: no photos.
+      if (respondToPlanespotters(request)) return;
       if (url.origin === APP_ORIGIN && url.pathname === '/api/openai/hud-summary') {
         request.respond({
           status: 200,