Load the God's Eye View panel through the MCP server

Hosts serve panels from their own sites and may refuse other addresses;
Codex refuses any address on the user's machine. The panel now never
requests the app's server: it loads the app's panel build and data
through panel_request, a tool only the panel may call, which requests
the path from the app's server. One path in every host; only map
providers load directly.

npm run build:panel writes the panel build to dist/panel, served at
/panel/: one app script, one stylesheet, Cesium's script, and Cesium's
workers as one script Cesium runs from memory. Tools may now be marked
app-only. The panel CORS rules are gone.

src/tools/surfaces.js

@@ -16,6 +16,8 @@ const mcpOff = Object.freeze({ mcp: false });
 export const TOOL_SURFACES = Object.freeze({
   // Voice runs inside the app, so a link to it adds nothing.
   show_in_gods_eye_view: voiceOff,
+  // Only the God's Eye View panel calls this, to load the app.
+  panel_request: voiceOff,
   // Voice has an app action of the same name.
   next_satellite_pass: voiceOff,
   // Voice receives text only, so tools that answer with an image are off.