fix(osm): gate place search like /api/overpass after #1308

#1308 moved /api/overpass to the keyless cross-site gate: foreign origins
and cross-site fetches are still refused, but forwarding headers are not,
so the map works behind a reverse proxy. Voice place search spends the same
operator Overpass, so it now uses the same gate; with the stricter one,
place search failed behind a proxy while the map kept working. The prompt
lint note records the merged size, 55,370 with an operator Overpass.

src/voice/pointAndAsk.test.mjs

@@ -346,7 +346,8 @@ test('deixis prompt lint: one short rule, and every sentinel it names exists in
   // it to 51,646. Voice geometry (resolve_area, find_imagery, osm_query and
   // the analyst area scopes) raised the ceiling to 55,500; tightening the
   // AREAS rule and the area tool descriptions left it at 55,263 with an
-  // operator Overpass, a deliberate ~240-character margin. A new tool or rule
+  // operator Overpass; main's Sea Marks and Ski Pistes layers bring it to
+  // 55,370, ~130 under. A new tool or rule
   // has to fit under this ceiling.
   const size = instructions.length + JSON.stringify(GEV_REALTIME_TOOLS).length;
   assert.ok(size <= 55_500, `prompt size ${size}`);