ci(street-level): run the browser gate hermetically with Mapillary fixtures

The Street Level and panel gates never ran in CI, and the live gate needs a
Mapillary token, the Mapillary network and real coverage at its test site,
so everything users see was guarded only by manual runs (which a bad token
and expired tile caches blocked twice this week).

`qa-street-level.mjs --fixtures` (npm run qa:street-level:fixtures) answers
the page's /api/mapillary/status and coverage-tile requests from generated
tiles (a street grid with flat and 360 deg sequences, half captured three
years ago; overview points from orbit) and blocks mapillary.com. Only the
six steps that open a photo are skipped. Because the data is known, the 360
deg and SINCE steps also assert that the filters remove sequences, not just
that counts do not grow. A unit test pins the fixture contents.

New CI job "Street Level browser gate": install with headless Chrome, start
a key-less dev server, run the fixture gate and qa:panel-resize. Locally,
against a dev server with every key blanked: 14/14 on three consecutive
runs, panel gate all pass.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/CURRENT-STATE.md

@@ -3025,6 +3025,16 @@ group in `src/data/layerState.js` and its modules to
 keyless provider registers, `requiresKeyId` on the layer becomes null and the
 key gate moves to the chips, by design.
 
+Street Level has two browser gates. `npm run qa:street-level -- --url <dev
+server>` is the live run: with `MAPILLARY_CLIENT_TOKEN` it covers everything
+up to opening, expanding and closing a photo. `npm run
+qa:street-level:fixtures -- --url <dev server>` is hermetic: the page's
+Mapillary status and coverage-tile requests are answered from generated
+fixtures (`providers/mapillary/coverageFixture.mjs`), so it needs no token or
+Mapillary network, skips only the photo steps, and asserts that the 360° and
+SINCE filters actually remove sequences. CI runs the fixture gate and
+`qa:panel-resize` against a key-less dev server.
+
 Directions is a keyless front end to the routing the voice agent already
 uses. Its row chips are the whole interface: DRIVE / WALK / BIKE pick the
 profile; SET A and SET B arm the next globe click (Escape or a second press