fix(server): declare the method contract on the three read-only query proxies

/api/opensky, /api/adsblol/mil and /api/route answered any verb with the same
body while ignoring the request entirely. Measured against a running server
before the change: POST /api/opensky returned 200 with 833,759 bytes of live
state vectors, POST /api/adsblol/mil returned 47,372 bytes. Their siblings do
not: /api/geocode, /api/weather and /api/transit answer 405, and /api/overpass
is deliberately POST-only.

These three are read-only query proxies, so they now answer 405 to anything but
GET, using the wording and shape /api/geocode already uses. The refusal comes
first, before rate limiting and before any upstream call, which the tests
assert by stubbing fetch to throw.

Scope, stated plainly: this is a consistency and intent fix. No rate limiter
was being bypassed — /api/route already limits every request regardless of
verb, and the two aircraft routes have no limiter at all, only 9s and 12s
server-side caches that bound upstream cost for any method.

One existing fixture in src/search/geospatial.test.mjs built a request without
a method, which a real Node request always has; it now sets GET.

Verified on a running server after the change: GET still 200 on all three,
POST 405 on all three, /api/overpass and the other proxies unchanged.
Suite goes from 5090 to 5092 tests, 0 failures.

server/providers/aircraft/adsb-lol.js

@@ -68,6 +68,13 @@ export function adsbLolProxy() {
 
   const installMiddleware = (server) => {
     server.middlewares.use('/api/adsblol/mil', async (req, res) => {
+      // Read-only snapshot endpoint; match the method contract its sibling
+      // query proxies already declare instead of serving every verb alike.
+      if (req.method !== 'GET') {
+        res.writeHead(405, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Method Not Allowed' }));
+        return;
+      }
       try {
         const now = Date.now();
         if (_cache && now - _cacheAt < CACHE_MS) {

server/providers/aircraft/opensky.js

@@ -350,6 +350,14 @@ function openSkySourceIsStale(sourceEpochMs, now = Date.now()) {
 export function openSkyProxy() {
   const installMiddleware = (server) => {
     server.middlewares.use('/api/opensky', async (req, res) => {
+      // Read-only snapshot endpoint: state the method contract the way
+      // /api/geocode and the other query proxies state it, rather than
+      // answering any verb with the same body and ignoring the request body.
+      if (req.method !== 'GET') {
+        res.writeHead(405, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Method Not Allowed' }));
+        return;
+      }
       try {
         const requestedMode = normalizeOpenSkyAuthMode(
           process.env.OPENSKY_AUTH_MODE,

server/providers/places/routes.js

@@ -227,6 +227,13 @@ export function installRouteMiddleware(
   // only shape that asks the upstream for them. A response WITHOUT steps is
   // byte for byte what this endpoint has always returned.
   middlewares.use('/api/route', async (req, res) => {
+    // The documented shape above is a GET with query parameters; say so,
+    // the way the other query proxies do, instead of answering any verb.
+    if (req.method !== 'GET') {
+      res.writeHead(405, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Method Not Allowed' }));
+      return;
+    }
     const fail = (msg) => {
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: false, error: msg }));