fix(overpass): rotate mirrors on any refusal, and never cache one as data

The proxy lists four mirrors and rotated on 5xx alone, so a 4xx ended the
fan-out. Measured against the live services: overpass-api.de and its lz4 alias
answer 406 to this proxy's User-Agent, while overpass.kumi.systems and
overpass.private.coffee answer 200 to the byte-identical request. Every
Overpass-backed feature — road geometry, annotation outlines, place lookup —
was failing on an Apache error page with two healthy mirrors untried.

The refusal was then cached. The cache guard read `status < 500`, so the error
page was written to memory and to disk, and the serve-stale guard used the same
threshold and declined to replace it. Boundary-class queries hold a month-long
TTL: four of twenty-three cached entries on this machine held that 406, dated
days after the mirror had stopped refusing.

Both decisions now go through one predicate. A payload is data only when it is
a 2xx that is neither rate-limited nor a body-level runtime error, so what may
be cached and what may be replaced by a stale entry cannot drift apart again.

A refusal every mirror agrees on is still reported with the first mirror's
status and body, so a malformed query says what upstream said — after every
mirror has had its chance, not instead of it. fetchOverpassPayload takes
injectable endpoints and fetch so the rotation is covered without a live
mirror; restoring either half of the old behaviour fails the new tests.

CHANGELOG.md

@@ -5,6 +5,16 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
 
 ## [Unreleased]
 
+### Fixed
+
+- The Overpass proxy now rotates to the next mirror on any non-2xx upstream
+  response, not only on 5xx. `overpass-api.de` and its `lz4` alias answer 406 to
+  the proxy's User-Agent while two of the configured mirrors answer 200 to the
+  identical request, so the fan-out stopped at the first refusal with healthy
+  mirrors untried. The refusal was also cached to memory and disk and served as
+  data — boundary-class queries hold a month-long TTL — which affected every
+  Overpass-backed feature: road geometry, annotation outlines and place lookup.
+
 ## [0.1.1] — 2026-09-01 — Installation and live-data fixes
 
 ### Changed