Merge branch 'main' into feat/voice-geometry

Picks up #1308 (Overpass admission), #114 (Sea Marks and Ski Pistes),
#1206 (radio country coverage) and #1435. Resolutions:
- SECURITY.md: main's rewritten cross-site paragraph, with voice place
  search listed beside /api/overpass among the keyless map routes.
- scripts/format-scope.json: both sides. A merge on main dropped 97 entries
  (being restored there); keeping them, this PR's 12 and main's 2 new ones
  keeps every file in format:check. All 1,222 paths exist.
- Translation catalogs: main's two new keys and this PR's 47, no overlap.
- Layer count 36 (33 + OSM Places + Sea Marks + Ski Pistes); both schema
  pins re-derived, the first-run length is exactly 30,919 + 292 + 107.

scripts/format-scope.json

@@ -1218,5 +1218,7 @@
   "src/voice/areaActions.test.mjs",
   "src/voice/imageryActions.test.mjs",
   "src/voice/osmActions.test.mjs",
-  "src/voice/realtimeProtocol.test.mjs"
+  "src/voice/realtimeProtocol.test.mjs",
+  "src/tooling/trackArrivalObservation.mjs",
+  "server/providers/common/rateLimitKeys.test.mjs"
 ]