Street Level: docs for the OPEN exception, panel freshness and what stops a request

- SECURITY.md: OPEN also takes the link's point when the screen centre
  cannot be picked at all.
- TOOLS.md: the panel's own link opens Street View only for a result issued
  in the last five minutes; an older one only arms.
- Changelog: the hiding modes stop a request, collapsing the panel does not;
  failure cards are in the interface language.
- CURRENT-STATE: a posted view without a point grounds its look-at too.

docs/CURRENT-STATE.md

@@ -5315,9 +5315,10 @@ a point, which defaults to where the camera looks (below 20 km, at a pitch
 steeper than -5° and within 10 km ahead; else the camera's own point, also
 for half a point). A `google` source brings `map: photoreal` and refuses
 another map; `street_level` does not combine with `follow`.
-`show_in_gods_eye_view` measures a view's altitude from the terrain under the
-camera (`services.terrain`) before taking the look-at point, and keeps the
-view's own estimate without a terrain answer. Links carry
+`show_in_gods_eye_view`, and the embedded app for a posted view with no
+point, measure the view's altitude from the terrain under the camera
+(`groundedLookAt` with the terrain heights service) before taking the look-at
+point, and keep the view's own estimate without a terrain answer. Links carry
 `sl=<source>,<lat>,<lon>`; the globe panel applies views through the action,
 and a plain link runs it once restored (one shot: the rewritten hash drops
 `sl`). A link that follows an entity ignores `sl`.

docs/TOOLS.md

@@ -110,8 +110,10 @@ shows only on the Google 3D map, so a `google` source sets `map` to
 photos. Links carry it as `sl=<source>,<lat>,<lon>`: once restored, the app
 runs `show_street_level`, which flies there and opens the nearest photo. A
 plain link with a `google` source only arms the panel for OPEN GOOGLE STREET
-VIEW; a view posted into the embedded app, or the panel page's own opening
-link, opens it, and `?embed=1` on a published link does not. Mapillary,
+VIEW; a view posted into the embedded app opens it, and so does the panel
+page's own opening link, but only for a tool result issued in the last five
+minutes (an older one, such as a host remounting the panel, only arms);
+`?embed=1` on a published link does not. Mapillary,
 KartaView and Panoramax, which do not bill per image, open at once. A link
 that follows an entity ignores `sl`.