fix(osm): gate place search like /api/overpass after #1308

#1308 moved /api/overpass to the keyless cross-site gate: foreign origins
and cross-site fetches are still refused, but forwarding headers are not,
so the map works behind a reverse proxy. Voice place search spends the same
operator Overpass, so it now uses the same gate; with the stricter one,
place search failed behind a proxy while the map kept working. The prompt
lint note records the merged size, 55,370 with an operator Overpass.

src/tooling/osmFeaturesRoute.test.mjs

@@ -380,6 +380,14 @@ test('a cross-site page cannot spend the operator Overpass', async () => {
     'sec-fetch-site': 'same-origin',
   });
   assert.equal(own.status, 200);
+  // Like /api/overpass, it works behind a reverse proxy: forwarding headers
+  // alone are not a refusal.
+  const proxied = await request('preset=school&bbox=0,0,2,2', undefined, {
+    host: 'localhost:5173',
+    'sec-fetch-site': 'same-origin',
+    'x-forwarded-for': '203.0.113.7',
+  });
+  assert.equal(proxied.status, 200);
 });
 
 test('an upstream refusal is not an empty answer', async () => {