fix(overpass): keyless gate, loopback admission headroom and per-phase arrival budgets

Address gekh's review of 69a87fe2:

- P1: /api/overpass now uses admitSameSiteKeyless, like /api/terrain/heights,
  so an instance behind the README's reverse proxy keeps its Overpass-backed
  layers; cross-site shapes are still refused and forwarding headers no
  longer launder them. SECURITY.md, the gate header and CURRENT-STATE say so.
- P2: admission keys IPv6 peers by /64 and folds IPv4-mapped peers
  (clientNetworkKey), and loopback has its own 300/min window outside the
  900/min global, so a few LAN peers cannot lock the owner's browser out.
- P2 (track): the settle and reveal frames each get their own 500 ms budget,
  measured from moveEnd and from the settle frame respectively, so a ~300 ms
  SwiftShader frame no longer trips the reveal deadline while both stay
  inside the 1 s idle refresh.
- Smaller: drop the dead settings-block check and stale probe comment in
  query.js, clamp whitespace-tolerant [ timeout : N ], and add tests for the
  global window, the /64 keying, loopback headroom, proxied admission and
  cache hits spending admission but not upstream budget.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

changelog.d/1264-overpass-request-admission.md

@@ -5,5 +5,5 @@
   browser validation can settle; the Overpass gate recognizes only that probe's
   expected 404 as an unavailable capability (asturksever, #1264).
 - Make tracking arrival checks respect the aircraft update cadence while checking
-  orientation on the first reveal, avoiding false failures at faster render
-  rates (asturksever, #1264).
+  orientation on the first reveal, avoiding false failures at faster or slower
+  render rates (asturksever, #1264).