Merge origin/main into german/navara

Main's camera, voice, Cockpit and layer work now runs on the globe
contract where this branch draws through it:

- The voice tilt to an angle, its pivot about the place under the
  crosshair and the frame limit from orbit run through the camera rig;
  src/globeInView.js measures a camera pose with src/geo instead of a
  Cesium camera. The free-look height limit and the globe-in-view
  recovery stay Cesium-only for now.
- Cockpit takes main's own-layer entry rule. Double-clicking the
  followed track goes through cockpitHost.routeDoubleClick, so it works
  on both engines.
- Space Missions' failed-entry rollback and GhostMaps' age filter run
  in the engine-neutral layer code. On Cesium an expired report is
  dropped in place; on Navara its product is redrawn.
- Wildlife Sightings joins the catalog Cesium-only: Navara leaves it
  out, and the shell builds its card only for the real layer, so a
  Navara page no longer fails to start on its stand-in.
- One instruction sentence is shorter, which keeps the Realtime prompt
  within its 55,500-character budget with the Sentinel-2 basemap.

scripts/qa-street-level.mjs

@@ -297,6 +297,22 @@ async function expandPanel(page) {
   );
 }
 
+/** A keyless bundle opens on the first keyless source with live controls. */
+async function assertKeylessDefault(page) {
+  await page.evaluate(() =>
+    window.__godsEyeView.dataManager.setEnabled('street-level', true, {
+      origin: 'user',
+    }),
+  );
+  await uiUntil(page, litAlone, 'kartaview');
+  const shown = await page.evaluate(() => ({
+    status: document.getElementById('sl-status').textContent,
+    disabled: document.getElementById('sl-controls').disabled,
+  }));
+  assert.notEqual(shown.status, 'KEY REQUIRED');
+  assert.equal(shown.disabled, false, 'controls stay live');
+}
+
 async function assertKeyRequired(page) {
   await page.evaluate(() =>
     window.__godsEyeView.dataManager.setEnabled('street-level', true, {
@@ -530,11 +546,25 @@ async function main() {
       );
 
     await expandPanel(page);
-    if (!configured) {
+    if (!configured && litAlone(await getUI(page), 'mapillary')) {
+      // A keyed bundle behind a server without the token keeps Mapillary.
       await step('keyless server: KEY REQUIRED gates the controls', () =>
         assertKeyRequired(page),
       );
       skip('no Mapillary key', 'the keyed steps');
+    } else if (!configured) {
+      await step('keyless server: opens on KartaView, not KEY REQUIRED', () =>
+        assertKeylessDefault(page),
+      );
+      await step(
+        'keyless server: the MAPILLARY chip explains its key instead of switching',
+        async () => {
+          await press(page, '#sl-provider-chips [data-chip-id="mapillary"]');
+          await new Promise((resolve) => setTimeout(resolve, 500));
+          assert.ok(litAlone(await getUI(page), 'kartaview'));
+        },
+      );
+      skip('no Mapillary key', 'the keyed steps');
     } else {
       await park(page);
       await step(
@@ -753,6 +783,8 @@ async function main() {
       await park(page);
 
       await fixtureStep(
+        // The fixture bundle carries a token, so this covers a keyless
+        // server behind a keyed bundle; the keyless default is checked above.
         'keyless server (second page): KEY REQUIRED gates the controls',
         async () => {
           const keyless = await open(