Merge branch 'feat/voice-geometry' into maintainer fixes

Picks up acd87e6c: the keyless cross-site gate on /api/osm/features
(582bfce6) and main at 93804d5d. SECURITY.md, the format-scope list and
the schema-test comments take the branch's side; the place-search budget
wording from the timeout fix is kept.

src/firstRunExperience.test.mjs

@@ -1037,8 +1037,8 @@ test('the voice TOOL SCHEMA matches the pinned contract — the mission mapping
   // S2 GhostMaps extends the generated layer enums; both feature contracts remain.
   // The layer alias hint leaves out aliases the layer id already spells.
   // The Utilities panel adds one set_panel_open target; Sea Marks and Ski
-  // Pistes extend the generated layer enums and alias hint.
-  // Voice geometry adds the analyst area scopes and the osm-places layer.
+  // Pistes extend the generated layer enums and alias hint; voice geometry
+  // adds the analyst area scopes and the osm-places layer.
   assert.equal(block.length, 31318, 'serialized tool schema length drifted');
   assert.equal(
     crypto.createHash('sha256').update(block).digest('hex'),

src/tooling/osmFeaturesRoute.test.mjs

@@ -419,6 +419,14 @@ test('a cross-site page cannot spend the operator Overpass', async () => {
     'sec-fetch-site': 'same-origin',
   });
   assert.equal(own.status, 200);
+  // Like /api/overpass, it works behind a reverse proxy: forwarding headers
+  // alone are not a refusal.
+  const proxied = await request('preset=school&bbox=0,0,2,2', undefined, {
+    host: 'localhost:5173',
+    'sec-fetch-site': 'same-origin',
+    'x-forwarded-for': '203.0.113.7',
+  });
+  assert.equal(proxied.status, 200);
 });
 
 test('an upstream refusal is not an empty answer', async () => {

src/voice/actionSchemas.test.mjs

@@ -55,7 +55,6 @@ test('the complete Realtime tool payload pins the manifest-generated layer relea
     // Voice geometry adds resolve_area, find_imagery, osm_query, the analyst
     // area scopes and the osm-places layer; natural-region candidates and the
     // tightened area tool wording follow review.
-    // Sea Marks and Ski Pistes extend the generated layer enums and alias hint.
     'd0c5ad733670972713a54cb10676c42b7c6e78834bfff52b473c0e8a45e742c3',
   );
 });

src/voice/pointAndAsk.test.mjs

@@ -346,7 +346,8 @@ test('deixis prompt lint: one short rule, and every sentinel it names exists in
   // it to 51,646. Voice geometry (resolve_area, find_imagery, osm_query and
   // the analyst area scopes) raised the ceiling to 55,500; tightening the
   // AREAS rule and the area tool descriptions left it at 55,263 with an
-  // operator Overpass, a deliberate ~240-character margin. A new tool or rule
+  // operator Overpass; main's Sea Marks and Ski Pistes layers bring it to
+  // 55,370, ~130 under. A new tool or rule
   // has to fit under this ceiling.
   const size = instructions.length + JSON.stringify(GEV_REALTIME_TOOLS).length;
   assert.ok(size <= 55_500, `prompt size ${size}`);