fix(status): stop false LOAD FAILED from a relayed adsb.lol 429 and the installations zoom prompt

Two independent triggers turned the global status chip red while every layer
was still populated (reproduced at JFK in Cockpit; timeline in the issue).

adsb.lol proxy: a non-OK upstream status was relayed verbatim even with a
12 s-old cache in hand, and the browser layer answers a 429 with a 45 s
cooldown in which every refresh reports "adsb.lol rate limited" without a
network call. The proxy now serves its cached body as STALE on a 429/5xx and
backs off from upstream for Retry-After (bounded), mirroring the OpenSky
proxy. A failure with nothing cached is still relayed.

Mapped installations: the "zoom in" guidance was stored in `error`, so the
manager reported a refresh failure and the chip a LOAD FAILED whenever the
view could not be bounded (Cockpit looks at the horizon). The status is now
set without an error string; the row reads the prompt from `statusMessage`,
and the chip ignores `error` for guidance statuses, matching the carve-out
layerFeedState already has.

src/data/militaryInstallations.js

@@ -425,12 +425,18 @@ function scheduleLoad() {
 async function loadInstallations() {
   if (!state.enabled || !state.viewer) return;
   const box = viewportBox(state.viewer);
+  // Guidance, not a fault: the layer chose not to query because the view is
+  // unbounded (a global view, or Cockpit looking at the horizon). Keep it out
+  // of `error` — the manager derives refresh failures and the global status
+  // chip derives LOAD FAILED from that field, and a "zoom in" prompt turned
+  // every Cockpit refresh into a reported failure. The row and toast read the
+  // prompt from `statusMessage` (installationFeedback) instead.
   if (!box) {
     state.abort?.abort();
     state.abort = null;
     state.loading = false;
     clearUnavailableRetry();
-    setInstallationStatus('zoom-in', 'Zoom in to load mapped installation context');
+    setInstallationStatus('zoom-in');
     return;
   }
   state.abort?.abort();