Merge upstream/main into pr/mapillary-layer

Twenty layers now (weather, wind, cyclones and recent imagery landed
upstream); Street Level sits after Recent Imagery in the right rail and the
Cameras group, and the rail CSS names it beside the other panels.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

src/setupDoctor.test.mjs

@@ -12,6 +12,7 @@ import {
   isConfiguredValue,
   npmProcessSpec,
   readDoctorDotenvValue,
+  resolveOpenSkyAuthMode,
   resolveCredential,
 } from '../scripts/setup-doctor.mjs';
 
@@ -170,6 +171,88 @@ test('doctor reads the dotenv ladder without requiring Vite to be installed', ()
   }
 });
 
+test('doctor resolves OpenSky auth mode with launcher-compatible precedence', () => {
+  const root = mkdtempSync(path.join(tmpdir(), 'gev-doctor-opensky-mode-'));
+  try {
+    writeFileSync(path.join(root, '.env'), 'OPENSKY_AUTH_MODE=anon\n');
+    assert.equal(
+      resolveOpenSkyAuthMode({ environment: {}, rootDir: root }),
+      'anon',
+    );
+    assert.equal(
+      resolveOpenSkyAuthMode({
+        environment: { OPENSKY_AUTH_MODE: 'oauth' },
+        rootDir: root,
+      }),
+      'oauth',
+    );
+    assert.equal(
+      resolveOpenSkyAuthMode({
+        environment: { OPENSKY_AUTH_MODE: '' },
+        rootDir: root,
+      }),
+      'anon',
+    );
+    assert.equal(
+      resolveOpenSkyAuthMode({
+        environment: { OPENSKY_AUTH_MODE: 'invalid' },
+        rootDir: root,
+      }),
+      'oauth',
+    );
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('doctor reports keyless anonymous OpenSky access for explicit anon mode', () => {
+  const credentials = {
+    OPENSKY_CLIENT_ID: { configured: true },
+    OPENSKY_CLIENT_SECRET: { configured: true },
+  };
+  assert.equal(
+    buildCapabilitySummary(credentials, { openSkyAuthMode: 'anon' }).flights,
+    'OpenSky keyless anonymous access (rate-limited)',
+  );
+});
+
+test('doctor retains OAuth capability wording for a complete client pair', () => {
+  const credentials = {
+    OPENSKY_CLIENT_ID: { configured: true },
+    OPENSKY_CLIENT_SECRET: { configured: true },
+  };
+  assert.equal(
+    buildCapabilitySummary(credentials, { openSkyAuthMode: 'oauth' }).flights,
+    'OpenSky OAuth credentials present (runtime mode and validity not verified)',
+  );
+});
+
+test('doctor reports Basic mode without inferring runtime auth from OAuth credentials', () => {
+  const oauthCredentials = {
+    OPENSKY_CLIENT_ID: { configured: true },
+    OPENSKY_CLIENT_SECRET: { configured: true },
+  };
+  for (const credentials of [{}, oauthCredentials]) {
+    assert.equal(
+      buildCapabilitySummary(credentials, { openSkyAuthMode: 'basic' }).flights,
+      'OpenSky Basic mode selected (credential presence and validity not verified)',
+    );
+  }
+});
+
+test('doctor reports auto mode without assuming its eventual credential choice', () => {
+  const oauthCredentials = {
+    OPENSKY_CLIENT_ID: { configured: true },
+    OPENSKY_CLIENT_SECRET: { configured: true },
+  };
+  for (const credentials of [{}, oauthCredentials]) {
+    assert.equal(
+      buildCapabilitySummary(credentials, { openSkyAuthMode: 'auto' }).flights,
+      'OpenSky auto mode selected (runtime credential choice and validity not verified)',
+    );
+  }
+});
+
 test('doctor describes the credential ladder without exposing values', () => {
   const credentials = {
     GOOGLE_MAPS_API_KEY: { configured: false },
@@ -195,7 +278,7 @@ test('doctor describes the credential ladder without exposing values', () => {
   assert.match(capabilities.missions, /token allowance/);
   assert.equal(
     capabilities.flights,
-    'OpenSky OAuth credentials not configured',
+    'OpenSky keyless anonymous access (rate-limited)',
   );
 
   const report = formatSetupReport({