Merge branch 'feat/voice-geometry' into maintainer fixes

Picks up acd87e6c: the keyless cross-site gate on /api/osm/features
(582bfce6) and main at 93804d5d. SECURITY.md, the format-scope list and
the schema-test comments take the branch's side; the place-search budget
wording from the timeout fix is kept.

src/tooling/osmFeaturesRoute.test.mjs

@@ -419,6 +419,14 @@ test('a cross-site page cannot spend the operator Overpass', async () => {
     'sec-fetch-site': 'same-origin',
   });
   assert.equal(own.status, 200);
+  // Like /api/overpass, it works behind a reverse proxy: forwarding headers
+  // alone are not a refusal.
+  const proxied = await request('preset=school&bbox=0,0,2,2', undefined, {
+    host: 'localhost:5173',
+    'sec-fetch-site': 'same-origin',
+    'x-forwarded-for': '203.0.113.7',
+  });
+  assert.equal(proxied.status, 200);
 });
 
 test('an upstream refusal is not an empty answer', async () => {