test(osm): cover the place-search client and the follow-up handoff

From review:
- The browser client for /api/osm/features gets its own tests (request
  shape, abort, network failure, coded refusals), and a 200 whose body is
  not JSON is now a failure instead of zero places.
- An end-to-end test runs resolve_area, osm_query and an analyst follow-up
  through the real runner and checks the follow-up keeps the area; it fails
  with the wiring reverted.
- The Realtime token test pins Overpass off and compares the full tool
  schemas again instead of names taken from the environment.

src/tooling/localServices.test.mjs

@@ -747,6 +747,8 @@ test('Realtime service configuration selects compatible endpoint/model without f
         endpoint: 'https://voice.example/client-secrets',
         models: { standard: 'configured-model' },
         resolveApiKey: () => 'server-fixture',
+        // Pinned, so the expected tool list never depends on this machine's env.
+        overpassConfigured: () => false,
         fetchImpl: async (url, options) => {
           assert.equal(url, 'https://voice.example/client-secrets');
           assert.equal(options.redirect, 'error');
@@ -754,10 +756,8 @@ test('Realtime service configuration selects compatible endpoint/model without f
           const payload = JSON.parse(options.body);
           assert.equal(payload.session.model, 'configured-model');
           assert.deepEqual(
-            payload.session.tools.map((tool) => tool.name),
-            realtimeTools({
-              overpass: Boolean(process.env.OVERPASS_UPSTREAMS),
-            }).map((tool) => tool.name),
+            payload.session.tools,
+            realtimeTools({ overpass: false }),
           );
           return Response.json({ value: 'short-lived-fixture' });
         },