feat(mapillary): catalog, layer state, sources, key setup and build wiring

MAPILLARY_CLIENT_TOKEN is a public client token and reaches the browser
through the explicit define block; ANTHROPIC_API_KEY stays server-side.
Both appear in POWER UP with links to create them.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

.env.example

@@ -52,10 +52,6 @@ GOOGLE_MAPS_SERVER_API_KEY=
 # CLIENT-EXPOSED — use a public assets:read token with URL restrictions.
 CESIUM_ION_TOKEN=
 
-# Optional: switch the voice agent OFF entirely (no GEV MIC control, no
-# Realtime session). Typed controls such as Mapillary AI keep working.
-# Default is on. Restart the dev server after changing it.
-# GEV_VOICE_UI=off
 # Optional: OpenAI Realtime voice control. Do not prefix with VITE_.
 OPENAI_API_KEY=
 OPENAI_REALTIME_MODEL=gpt-realtime-2
@@ -80,14 +76,14 @@ OPENAI_HUD_SUMMARY_MODEL=gpt-5-nano
 # GEV_RATELIMIT_OPENAI_PER_MIN=30
 
 # Optional: Mapillary street-level imagery — coverage lines, detected objects
-# and traffic signs, the embedded MapillaryJS viewer and the Mapillary AI query.
+# and traffic signs, the embedded MapillaryJS viewer and the plain-English query box.
 # Free client token: https://www.mapillary.com/dashboard/developers (register an
 # application, copy the "Client Token"). CLIENT-EXPOSED by design: MapillaryJS
 # fetches imagery straight from Mapillary in the browser, so this token is in
 # the bundle like GOOGLE_MAPS_API_KEY. Mapillary client tokens are meant to be
 # public; the dev server also uses it to fetch and cache vector tiles.
 MAPILLARY_CLIENT_TOKEN=
-# Optional: Anthropic key for Mapillary AI ("show me all fire hydrants in
+# Optional: Anthropic key for the Street Level query box ("show me all fire hydrants in
 # Sacramento" -> a query plan drawn on the globe). SERVER-SIDE ONLY: the
 # browser posts the sentence to /api/mapillary/plan and never sees the key.
 # The SDK also honours an `ant auth login` profile when this is unset.