docs(street-level): shorten docs and comments before merge

Trim the doc text this PR adds (README, CHANGELOG, CURRENT-STATE,
KNOWN-ISSUES, SECURITY, DATA_SOURCES, .env.example, the CI job comment),
drop code comments that restate the code, cut design-note JSDoc to a line
or two, and drop review tags from test names. Comments only; no code
changes.

Also: README key count (seven keys, two metered), CURRENT-STATE's gate
paragraph (CI runs a production build with a dummy token), the stacked
doc above meshBoxInRange and the orphaned inMeshRange line in
coverage.js, and a duplicate ALPR row in DATA_SOURCES that a merge had
brought back.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/providers/mapillary/routes.js

@@ -70,8 +70,7 @@ async function handleTile(req, res, allow) {
           retryAfter,
         });
       }
-      // Any other refusal is Mapillary's fault, not the client's: an
-      // upstream 400 must not read as a malformed request to this proxy.
+      // An upstream 400 must not read as a malformed request to this proxy.
       return sendJson(res, 502, { error: error.message });
     }
     sendJson(res, 502, { error: error?.message || 'Tile fetch failed' });
@@ -79,11 +78,8 @@ async function handleTile(req, res, allow) {
 }
 
 /**
- * Attach every Mapillary route to a connect-style middleware stack. Both
- * refuse cross-site browser requests (server/providers/common/same-site.js):
- * another page could otherwise spend the user's token, and one Mapillary 429
- * it provokes holds every tile miss. Tiles are also rate-limited per client
- * IP (TILE_ROUTE_MAX_PER_MIN).
+ * Attach the Mapillary routes. Both refuse cross-site requests so another page
+ * cannot spend the token or provoke a 429 that holds every tile miss.
  */
 export function installMapillaryRoutes(middlewares) {
   const allow = makeRateLimiter({