fix(security): add cross-site gate to military-installations proxy

The /api/military-installations endpoint was the last keyless proxy without
the admitSameSite gate that protects terrain, CCTV, traffic, places, and
Celestrak. A cross-site <img>, foreign Origin, opaque origin, or
reverse-proxy-forwarded request now receives 403 before any Overpass query.
Same-origin app requests and bare tool requests continue to work.

Adds 4 integration tests (cross-site refused, same-origin admitted,
bare tool admitted, proxied refused) following the terrainHeightsBounds
test pattern.

changelog.d/1427-military-installations-cross-site-gate.md

@@ -0,0 +1,6 @@
+- The military-installations proxy (`/api/military-installations`) now refuses
+  cross-site browser requests with the same `admitSameSite` gate that protects
+  the terrain, CCTV, traffic, places, and Celestrak proxies. A cross-site
+  `<img>`, a foreign `Origin`, an opaque origin, or a reverse-proxy-forwarded
+  request receives 403 before any Overpass query runs. Same-origin app requests
+  and bare tool requests (curl, Node harness) continue to work. (Sunil56224972)