Merge upstream/main into fix/363-geocode-proxy

Resolve SECURITY.md against the Street View provider (#966): the browser
key now loads the Maps JavaScript API as well as Map Tiles, so the
'Map Tiles only' guidance becomes 'Map Tiles + Maps JavaScript API'
here and in CHANGELOG, CURRENT-STATE and google-key.js. The CHANGELOG
entry moves to [Unreleased]; its old section shipped in 0.2.0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/search/defaults.js

@@ -6,9 +6,10 @@ import { createGoogleGeocoder } from './google.js';
 import { createPhotonGeocoder } from '../keylessGeocoder.js';
 import { createCoordinateGeocoder } from './coordinateGeocoder.js';
 import { createPresetGeocoder } from './presetGeocoder.js';
+import { createAlpsGeocoder } from './alpsGeocoder.js';
 
 /**
- * Coordinates and bundled names first — both answer offline and with no key —
+ * Coordinates, bundled names and the unqualified Alps first — all offline —
  * then Google when configured, then keyless Photon, then the local Nominatim
  * route as a last resort. Transport stays local to setup.
  *
@@ -37,6 +38,7 @@ export function createDefaultPlaceSearch({
     providers: providers.geocode || [
       createCoordinateGeocoder(),
       ...(presets ? [createPresetGeocoder({ presets })] : []),
+      createAlpsGeocoder(),
       ...(selected
         ? [selected]
         : [