Merge upstream/main into pr/google-street-view

Conflicts with upstream's Street Level provider composition and share-state
codec, resolved:

- Street View's switch moves from its own share option (`g`) to upstream's
  provider-switch field (`r`, e.g. `0.r.google-1`); a link without it keeps
  Street View off. Docs and the browser gate follow.
- createApplicationStreetLevel keeps upstream's injectable provider list;
  its default, once the application supplies its Street Level source, is
  Mapillary plus Google Street View. Without that source there are none, as
  upstream intends.
- The coverage hint keeps upstream's empty-composition message and joins
  every switched-on provider's hint otherwise.
- CHANGELOG, README and SECURITY keep both sides' entries.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/app/layers/streetLevel.test.mjs

@@ -1,24 +1,51 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 import { createApplicationStreetLevel } from './streetLevel.js';
-import { createDefaultLayerState } from '../../data/layerState.js';
+import { fakeStreetLevelProvider } from '../../testSupport/streetLevelFakes.mjs';
 
-test('each provider starts as its share-link option does, so a fresh page and a restored one agree', () => {
-  const layer = createApplicationStreetLevel({
-    surface: null,
-    sources: {
-      mapillary: {
-        getStatus() {},
-        getTile() {},
-        getSequenceImages() {},
-        nearestImages() {},
-      },
-    },
+test('explicit providers replace the default source and an empty list removes it', () => {
+  const sources = { mapillary: {} };
+  const provider = fakeStreetLevelProvider({
+    id: 'example',
+    pickPrefix: 'example:',
   });
-  const options = createDefaultLayerState().options['street-level'];
-  // Every registered provider, listed on this map or not.
-  const started = layer.getParams();
-  for (const id of layer.providerIds)
-    assert.equal(started[id], options[id], id);
-  assert.equal(options.google, false, 'Street View is billed: off');
+  const layer = createApplicationStreetLevel({
+    sources,
+    providers: [provider],
+  });
+  assert.deepEqual(layer.providerIds, ['example']);
+  assert.deepEqual(
+    createApplicationStreetLevel({ sources, providers: [] }).providerIds,
+    [],
+  );
+  assert.throws(
+    () => createApplicationStreetLevel({ sources }),
+    /Mapillary source/,
+  );
+  assert.throws(
+    () => createApplicationStreetLevel({ providers: null }),
+    /array/,
+  );
+});
+
+test('the defaults are Mapillary (given its source) and Street View, which starts off and travels as a provider switch', async () => {
+  const { createDefaultLayerState } = await import('../../data/layerState.js');
+  const mapillary = {
+    getStatus() {},
+    getTile() {},
+    getSequenceImages() {},
+    nearestImages() {},
+  };
+  const layer = createApplicationStreetLevel({ sources: { mapillary } });
+  assert.deepEqual(layer.providerIds, ['mapillary', 'google']);
+  // A fresh page and a restored default agree: Street View is billed, so off.
+  layer.setParams(createDefaultLayerState().options['street-level']);
+  assert.equal(layer.getParams().google, false);
+  assert.equal(layer.getParams().mapillary, true);
+  // A link that lit Street View carries it in the shared switch field.
+  layer.setParams({ providerSwitches: 'google-1' });
+  assert.equal(layer.getParams().google, true);
+  assert.equal(layer.getParams().providerSwitches, 'google-1');
+  // Without the application's Street Level source there are none.
+  assert.deepEqual(createApplicationStreetLevel({}).providerIds, []);
 });