fix(status): stop false LOAD FAILED from a relayed adsb.lol 429 and the installations zoom prompt

Two independent triggers turned the global status chip red while every layer
was still populated (reproduced at JFK in Cockpit; timeline in the issue).

adsb.lol proxy: a non-OK upstream status was relayed verbatim even with a
12 s-old cache in hand, and the browser layer answers a 429 with a 45 s
cooldown in which every refresh reports "adsb.lol rate limited" without a
network call. The proxy now serves its cached body as STALE on a 429/5xx and
backs off from upstream for Retry-After (bounded), mirroring the OpenSky
proxy. A failure with nothing cached is still relayed.

Mapped installations: the "zoom in" guidance was stored in `error`, so the
manager reported a refresh failure and the chip a LOAD FAILED whenever the
view could not be bounded (Cockpit looks at the horizon). The status is now
set without an error string; the row reads the prompt from `statusMessage`,
and the chip ignores `error` for guidance statuses, matching the carve-out
layerFeedState already has.

server/providers/aircraft/adsb-lol.js

@@ -1,8 +1,16 @@
 /**
  * Vite plugin: adsb.lol military aircraft proxy with 12 s response cache.
  *
- * Proxies GET /api/adsblol/mil to https://api.adsb.lol/v2/mil. On upstream
- * failure, serves a stale cached response if one exists.
+ * Proxies GET /api/adsblol/mil to https://api.adsb.lol/v2/mil. When upstream
+ * fails — a thrown fetch OR a non-OK status such as 429 — the proxy serves its
+ * cached body as STALE instead of relaying the failure, and it backs off from
+ * upstream for the Retry-After period (bounded) so a rate limit is never
+ * hammered mid-cooldown. A failure with nothing cached is relayed as-is.
+ *
+ * Why the non-OK case matters: the browser layer treats a relayed 429 as a
+ * 45 s cooldown during which EVERY refresh (the 15 s poll and any tracking
+ * resolve) reports "adsb.lol rate limited", which the global status chip
+ * renders as LOAD FAILED while the map is still fully populated.
  *
  * @returns {import('vite').Plugin}
  */
@@ -11,19 +19,72 @@ export function adsbLolProxy() {
   let _cache = null;
   /** @type {number} Epoch-ms when the cache was populated. */
   let _cacheAt = 0;
+  /** @type {number} Epoch-ms until which upstream is not contacted. */
+  let _cooldownUntil = 0;
+  /** @type {number} Upstream status that started the current cooldown. */
+  let _cooldownStatus = 0;
   /** Response cache TTL (ms). */
   const CACHE_MS = 12000;
+  /** Cooldown after a 429 when upstream sends no usable Retry-After (ms). */
+  const RATE_LIMIT_COOLDOWN_MS = 30000;
+  /** Cooldown after a 5xx (ms). */
+  const SERVER_ERROR_COOLDOWN_MS = 15000;
+  /** Bounds for an upstream-supplied Retry-After (ms). */
+  const COOLDOWN_MIN_MS = 5000;
+  const COOLDOWN_MAX_MS = 120000;
+
+  const clampCooldown = (ms) =>
+    Math.min(COOLDOWN_MAX_MS, Math.max(COOLDOWN_MIN_MS, ms));
+
+  /** Cooldown (ms) an upstream failure earns, honouring Retry-After when sane. */
+  function cooldownFor(upstream, now) {
+    const raw = upstream.headers?.get?.('retry-after');
+    if (raw) {
+      const seconds = Number(raw);
+      if (Number.isFinite(seconds) && seconds > 0)
+        return clampCooldown(seconds * 1000);
+      const at = Date.parse(raw);
+      if (Number.isFinite(at) && at > now) return clampCooldown(at - now);
+    }
+    return upstream.status === 429
+      ? RATE_LIMIT_COOLDOWN_MS
+      : SERVER_ERROR_COOLDOWN_MS;
+  }
+
+  function serve(res, status, body, cacheStatus, extra = {}) {
+    res.writeHead(status, {
+      'Content-Type': 'application/json',
+      'Cache-Control': 'no-store',
+      'X-ADS-B-Cache': cacheStatus,
+      ...extra,
+    });
+    res.end(body);
+  }
+
   const installMiddleware = (server) => {
     server.middlewares.use('/api/adsblol/mil', async (req, res) => {
       try {
         const now = Date.now();
         if (_cache && now - _cacheAt < CACHE_MS) {
-          res.writeHead(200, {
-            'Content-Type': 'application/json',
-            'Cache-Control': 'no-store',
-            'X-ADS-B-Cache': 'HIT',
-          });
-          res.end(_cache);
+          serve(res, 200, _cache, 'HIT');
+          return;
+        }
+        if (now < _cooldownUntil) {
+          const retryAfter = String(Math.ceil((_cooldownUntil - now) / 1000));
+          if (_cache) {
+            serve(res, 200, _cache, 'STALE', {
+              'X-ADS-B-Upstream-Status': String(_cooldownStatus),
+              'X-ADS-B-Retry-After-Seconds': retryAfter,
+            });
+            return;
+          }
+          serve(
+            res,
+            _cooldownStatus || 503,
+            JSON.stringify({ error: 'adsb.lol upstream cooling down' }),
+            'NONE',
+            { 'Retry-After': retryAfter },
+          );
           return;
         }
         const upstream = await fetch('https://api.adsb.lol/v2/mil', {
@@ -33,21 +94,32 @@ export function adsbLolProxy() {
         if (upstream.ok) {
           _cache = body;
           _cacheAt = now;
+          _cooldownUntil = 0;
+          _cooldownStatus = 0;
+          serve(res, 200, body, 'MISS');
+          return;
         }
-        res.writeHead(upstream.status, {
-          'Content-Type': 'application/json',
-          'Cache-Control': 'no-store',
-          'X-ADS-B-Cache': 'MISS',
-        });
-        res.end(body);
+        if (upstream.status === 429 || upstream.status >= 500) {
+          _cooldownUntil = now + cooldownFor(upstream, now);
+          _cooldownStatus = upstream.status;
+          console.warn(
+            `[adsb.lol Proxy] upstream ${upstream.status}; cooling down ${Math.round((_cooldownUntil - now) / 1000)} s${_cache ? ', serving stale' : ''}`,
+          );
+          if (_cache) {
+            serve(res, 200, _cache, 'STALE', {
+              'X-ADS-B-Upstream-Status': String(upstream.status),
+              'X-ADS-B-Retry-After-Seconds': String(
+                Math.ceil((_cooldownUntil - now) / 1000),
+              ),
+            });
+            return;
+          }
+        }
+        serve(res, upstream.status, body, 'MISS');
       } catch (e) {
         console.error('[adsb.lol Proxy]', e.message);
         if (_cache) {
-          res.writeHead(200, {
-            'Content-Type': 'application/json',
-            'X-ADS-B-Cache': 'STALE',
-          });
-          res.end(_cache);
+          serve(res, 200, _cache, 'STALE');
           return;
         }
         res.writeHead(502, { 'Content-Type': 'application/json' });