feat: name live feed routes and sources for what they serve

The flight, military and vessel feeds were named after the providers the
bundled server uses (/api/opensky, /api/adsblol/mil, /api/ais-live and
their track routes; createOpenSkySource, createAdsbLolSource,
createAisStreamSource). Any server should be able to answer a feed from
its own provider, so the feeds are now:

  /api/flights   /api/flights/track?icao24=
  /api/military  /api/military/track?hex=
  /api/vessels   /api/vessels/track?mmsi=

with createFlightSource, createMilitarySource and createVesselSource. The
old routes are removed. Each server names its provider in X-Feed-Source
(the bundled server sends OpenSky Network, adsb.lol and AISStream, so its
attribution is unchanged) and the military feed's cache state and age in
X-Feed-Cache and X-Feed-Age-Ms. Sources report the provider the server
names and fall back to the feed's name.

server/providers/aircraft/adsb-lol.js

@@ -1,7 +1,7 @@
 /**
  * Vite plugin: adsb.lol military aircraft proxy with 12 s response cache.
  *
- * Proxies GET /api/adsblol/mil to https://api.adsb.lol/v2/mil. When upstream
+ * Serves GET /api/military from https://api.adsb.lol/v2/mil. When upstream
  * fails — a thrown fetch OR a non-OK status such as 429 — the proxy serves its
  * cached body as STALE instead of relaying the failure, and it backs off from
  * upstream for the Retry-After period (bounded) so a rate limit is never
@@ -55,10 +55,11 @@ export function adsbLolProxy() {
     res.writeHead(status, {
       'Content-Type': 'application/json',
       'Cache-Control': 'no-store',
-      'X-ADS-B-Cache': cacheStatus,
+      'X-Feed-Source': 'adsb.lol',
+      'X-Feed-Cache': cacheStatus,
       ...(['HIT', 'STALE'].includes(cacheStatus)
         ? {
-            'X-ADS-B-Cache-Age-Ms': String(Math.max(0, Date.now() - _cacheAt)),
+            'X-Feed-Age-Ms': String(Math.max(0, Date.now() - _cacheAt)),
           }
         : {}),
       ...extra,
@@ -67,8 +68,11 @@ export function adsbLolProxy() {
   }
 
   const installMiddleware = (server) => {
-    server.middlewares.use('/api/adsblol/mil', async (req, res) => {
+    server.middlewares.use('/api/military', async (req, res, next) => {
       try {
+        // This mount also matches its /track route, served by its own handler.
+        if (new URL(req.url || '/', 'http://localhost').pathname !== '/')
+          return next();
         const now = Date.now();
         if (_cache && now - _cacheAt < CACHE_MS) {
           serve(res, 200, _cache, 'HIT');

server/providers/aircraft/opensky.js

@@ -380,8 +380,12 @@ function openSkySourceIsStale(sourceEpochMs, now = Date.now()) {
  */
 export function openSkyProxy() {
   const installMiddleware = (server) => {
-    server.middlewares.use('/api/opensky', async (req, res) => {
+    server.middlewares.use('/api/flights', async (req, res, next) => {
       try {
+        // This mount also matches its /track route, served by its own handler.
+        if (new URL(req.url || '/', 'http://localhost').pathname !== '/')
+          return next();
+        res.setHeader('X-Feed-Source', 'OpenSky Network');
         const requestedMode = normalizeOpenSkyAuthMode(
           process.env.OPENSKY_AUTH_MODE,
         );

server/providers/aircraft/tracks.js

@@ -3,11 +3,11 @@ import { readCappedResponseText } from '../common/http.js';
 /**
  * Vite plugin: aircraft track-history backfill proxies (PRD WS-F F1/F2).
  *
- * /api/opensky-track?icao24=<hex6> — OpenSky GET /tracks/all (experimental;
+ * /api/flights/track?icao24=<hex6> — OpenSky GET /tracks/all (experimental;
  *   own credit bucket, 4 credits per call on the free tier). OAuth via the
  *   shared coalesced token. 60s per-icao cache; 404/429 forwarded so the
  *   client can fall back to its accumulated trail silently.
- * /api/adsblol/trace?hex=<hex> — adsb.lol tar1090 readsb trace
+ * /api/military/track?hex=<hex> — adsb.lol tar1090 readsb trace
  *   (undocumented but live; no browser CORS, hence this proxy). Up to ~24h
  *   of real history per aircraft. Treat as best-effort; data is ODbL —
  *   credit "adsb.lol (ODbL)" in the UI.
@@ -65,7 +65,7 @@ export function trackBackfillProxies() {
   }
 
   function install(middlewares) {
-    middlewares.use('/api/opensky-track', async (req, res) => {
+    middlewares.use('/api/flights/track', async (req, res) => {
       try {
         const incoming = new URL(req.url || '', 'http://localhost');
         const icao24 = String(incoming.searchParams.get('icao24') || '')
@@ -93,7 +93,7 @@ export function trackBackfillProxies() {
       }
     });
 
-    middlewares.use('/api/adsblol/trace', async (req, res) => {
+    middlewares.use('/api/military/track', async (req, res) => {
       try {
         const incoming = new URL(req.url || '', 'http://localhost');
         const hex = String(incoming.searchParams.get('hex') || '')

server/providers/vessels/ais-live.js

@@ -71,14 +71,15 @@ let _aisWebSocketImpl;
  */
 export function aisLiveProxy() {
   function install(middlewares) {
-    middlewares.use('/api/ais-live', async (req, res) => {
+    middlewares.use('/api/vessels', async (req, res) => {
       try {
+        res.setHeader('X-Feed-Source', 'AISStream');
         ensureAisStreamConnection();
         const incoming = new URL(req.url || '', 'http://localhost');
 
         // Track sub-route MUST be handled before the rows snapshot — this
         // mount prefix-matches every subpath, so without this branch
-        // /api/ais-live/track would be silently answered with vessel rows.
+        // /api/vessels/track would be silently answered with vessel rows.
         if (
           incoming.pathname === '/track' ||
           incoming.pathname.startsWith('/track/')
@@ -288,7 +289,7 @@ function aisKeyFingerprint() {
 }
 
 /**
- * Drive the watchdog once. Called on every /api/ais-live request and on the
+ * Drive the watchdog once. Called on every /api/vessels request and on the
  * background interval, so recovery does not depend on browser traffic.
  */
 function ensureAisStreamConnection() {
@@ -307,7 +308,7 @@ function ensureAisStreamConnection() {
     keyFingerprint: aisKeyFingerprint(),
   });
 }
-/** Status metadata for /api/ais-live, safe to call before the first connect. */
+/** Status metadata for /api/vessels, safe to call before the first connect. */
 function aisStreamStatusSnapshot() {
   const snapshot = _aisAdapter ? _aisAdapter.snapshot() : null;
   if (snapshot) return snapshot;