fix(street-level): camera ownership, mesh refresh, panel CSP (Sameh's review)

- Photo framing and FOLLOW claim the camera through the application's
  navigation, injected with attachNavigation({ run, subscribeHandoff }):
  aircraft and satellite tracking is released first, the cockpit refuses,
  and FOLLOW stops when another feature takes the camera. No UI imports
  in the layer.
- The mesh sampler follows the mesh floor's rules: it waits for the
  visible tileset to finish streaming (visibleTilesetLoaded, now exposed
  by the mesh floor service), needs a real bare-earth prior and keeps to
  the shared meshFloorSampleWithinPrior window, which cameraFollow now
  uses too. A cell is probed again once the camera is half as far from
  it (down to 40 m), so a coarse early sample is replaced and redrawn.
- The MCP globe panel's CSP allows the Mapillary Graph API and its image
  CDN (https://*.xx.fbcdn.net).
- The tile proxy reads bodies with the shared readResponseBytesCapped.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/layers/streetLevel/index.js

@@ -40,8 +40,15 @@ export function createStreetLevelLayer({
   parts.groundCaster = services.terrain?.resolveEllipsoidalGround
     ? createGroundCaster({ terrain: services.terrain })
     : null;
+  // Mesh samples follow the application's rules: a real bare-earth prior,
+  // its mesh window, and a tileset that has finished streaming.
   parts.meshSampler = parts.groundCaster
-    ? createMeshSampler({ getViewer: () => state.viewer })
+    ? createMeshSampler({
+        getViewer: () => state.viewer,
+        groundAt: parts.groundCaster.groundAt,
+        withinPrior: services.ground?.meshFloorSampleWithinPrior ?? null,
+        tilesReady: services.meshFloor?.visibleTilesetLoaded ?? null,
+      })
     : null;
   parts.credits = createCredits();
   parts.marker = createMarker(context);
@@ -375,6 +382,7 @@ export function createStreetLevelLayer({
         entry.instance.destroy(viewer);
       parts.marker.destroy(viewer);
       parts.meshSampler?.destroy();
+      parts.follow.destroy();
       unsubscribeMapStack?.();
       unsubscribeMapStack = null;
       mapStack = null;
@@ -405,6 +413,15 @@ export function createStreetLevelLayer({
       };
     },
 
+    /**
+     * The application's camera authority: `run(noun, move)` and
+     * `subscribeHandoff(listener)`. Framing and FOLLOW claim the camera
+     * through it, and FOLLOW stops when another feature takes the camera.
+     */
+    attachNavigation(navigation) {
+      parts.follow.attachNavigation(navigation);
+    },
+
     /** The application map stack; FOLLOW is available only on Google 3D. */
     attachMapStackController(controller) {
       unsubscribeMapStack?.();