Merge branch 'main' into feat/voice-geometry

Picks up #1308 (Overpass admission), #114 (Sea Marks and Ski Pistes),
#1206 (radio country coverage) and #1435. Resolutions:
- SECURITY.md: main's rewritten cross-site paragraph, with voice place
  search listed beside /api/overpass among the keyless map routes.
- scripts/format-scope.json: both sides. A merge on main dropped 97 entries
  (being restored there); keeping them, this PR's 12 and main's 2 new ones
  keeps every file in format:check. All 1,222 paths exist.
- Translation catalogs: main's two new keys and this PR's 47, no overlap.
- Layer count 36 (33 + OSM Places + Sea Marks + Ski Pistes); both schema
  pins re-derived, the first-run length is exactly 30,919 + 292 + 107.

changelog.d/114-open-map-overlays.md

@@ -0,0 +1,3 @@
+- Add Sea Marks (OpenSeaMap) and Ski Pistes (OpenSnowMap) as two raster
+  overlay layers under Infrastructure. They drape on the globe stacks and on
+  Google 3D, and share links keep each one (Tom-Neverwinter, #114).

changelog.d/1206-radio-priority-countries.md

@@ -0,0 +1,6 @@
+- Add optional keyless Radio priority-country coverage with up to 40 stations
+  per configured country inside the existing 750-station cap; the UK alias uses
+  the canonical GB code. Country query
+  failures do not block a healthy global catalog. Bound mirror attempts to three
+  and retry failed or partial refreshes after 60 seconds on all installations,
+  including those without priority countries configured (m3ayush, #1206).

changelog.d/1308-overpass-admission-review-fixes.md

@@ -0,0 +1,13 @@
+- Keep Overpass-backed layers working behind a reverse proxy: `/api/overpass`
+  now uses the keyless same-site gate, admits forwarding headers and still
+  refuses cross-site requests. Direct loopback requests keep their own
+  admission window; proxied requests, including those a local reverse proxy
+  relays over loopback, are admitted as remote traffic keyed by their socket,
+  and IPv6 peers are keyed by /64, so neither LAN peers nor proxied users can
+  exhaust the owner's admission. The upstream budget stays shared, so an owner
+  cache miss can still be rate-limited (asturksever, #1308).
+- Give the tracking arrival check a wall-clock budget per observed frame and
+  retry only an inconclusive timeout: a timeout keeps every angle it
+  measured, including a late frame's, and a wrong one fails without retry, so slow software-rendered
+  frames no longer fail the check and a real violation is never retried into a
+  pass (asturksever, #1308).

changelog.d/1435-military-positionless-rows.md

@@ -0,0 +1,5 @@
+- Military aircraft that leave the adsb.lol feed fade and are removed again.
+  The feed's routine position-less rows no longer mark every snapshot partial,
+  which kept vanished aircraft at full opacity for up to five minutes; those
+  rows keep only their own aircraft, and a likely-landed one still leaves on
+  the landed limit (Aditya, @Rohilalala, #1435).