fix(street-level): camera ownership, mesh refresh, panel CSP (Sameh's review)

- Photo framing and FOLLOW claim the camera through the application's
  navigation, injected with attachNavigation({ run, subscribeHandoff }):
  aircraft and satellite tracking is released first, the cockpit refuses,
  and FOLLOW stops when another feature takes the camera. No UI imports
  in the layer.
- The mesh sampler follows the mesh floor's rules: it waits for the
  visible tileset to finish streaming (visibleTilesetLoaded, now exposed
  by the mesh floor service), needs a real bare-earth prior and keeps to
  the shared meshFloorSampleWithinPrior window, which cameraFollow now
  uses too. A cell is probed again once the camera is half as far from
  it (down to 40 m), so a coarse early sample is replaced and redrawn.
- The MCP globe panel's CSP allows the Mapillary Graph API and its image
  CDN (https://*.xx.fbcdn.net).
- The tile proxy reads bodies with the shared readResponseBytesCapped.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/tools/globePanel.js

@@ -14,8 +14,9 @@ export const PANEL_WORKER_PRELUDE_PATH = 'cesium/worker-prelude.js';
 
 /**
  * Sites the app's browser code loads from directly: map imagery, 3D tiles,
- * terrain and fonts. Everything from the app's own server comes through the
- * MCP server.
+ * terrain, fonts, and Street Level's Mapillary Graph API and image CDN (its
+ * coverage tiles come through the app's server). Everything from the app's
+ * own server comes through the MCP server.
  */
 const PROVIDER_ORIGINS = Object.freeze([
   'https://tile.googleapis.com',
@@ -35,6 +36,9 @@ const PROVIDER_ORIGINS = Object.freeze([
   'https://gibs.earthdata.nasa.gov',
   'https://fonts.googleapis.com',
   'https://fonts.gstatic.com',
+  'https://graph.mapillary.com',
+  // Mapillary photos come from regional hosts, e.g. scontent-man2-1.xx.fbcdn.net.
+  'https://*.xx.fbcdn.net',
 ]);
 
 export const MCP_APP_MIME_TYPE = 'text/html;profile=mcp-app';