Merge upstream/main into pr/google-street-view

Conflicts with upstream's Street Level provider composition and share-state
codec, resolved:

- Street View's switch moves from its own share option (`g`) to upstream's
  provider-switch field (`r`, e.g. `0.r.google-1`); a link without it keeps
  Street View off. Docs and the browser gate follow.
- createApplicationStreetLevel keeps upstream's injectable provider list;
  its default, once the application supplies its Street Level source, is
  Mapillary plus Google Street View. Without that source there are none, as
  upstream intends.
- The coverage hint keeps upstream's empty-composition message and joins
  every switched-on provider's hint otherwise.
- CHANGELOG, README and SECURITY keep both sides' entries.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.env.example

@@ -56,8 +56,14 @@ GOOGLE_MAPS_SERVER_API_KEY=
 # CLIENT-EXPOSED — use a public assets:read token with URL restrictions.
 CESIUM_ION_TOKEN=
 
-# Optional: OpenAI Realtime voice control. Do not prefix with VITE_.
+# Optional: OpenAI Realtime voice control. API key is the default cloud auth.
+# Provider Settings can instead opt voice into the signed-in local
+# ChatGPT/Codex OAuth session; the browser still receives only a short-lived
+# Realtime client secret. Do not prefix with VITE_.
 OPENAI_API_KEY=
+# Optional: forbid API-key voice sessions. Select ChatGPT OAuth in Provider
+# Settings; missing or expired Codex sign-in then fails closed.
+# GEV_PREFER_CODEX_OAUTH=true
 OPENAI_REALTIME_MODEL=gpt-realtime-2
 # Cheaper voice tier, used when the GEV MIC panel's MINI toggle is on.
 # Model ids and prices are external facts that drift — if OpenAI moves this id,