release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

The first formal release.

- One-click install via Pinokio; keyless boot lands on a live Esri World
  Imagery satellite globe with keyless terrain, with automatic OSM fallback
  and graceful degradation when terrain is unavailable.
- Provider Settings (the POWER UP panel): add, replace, or remove API keys
  inside the app; credential files made owner-only before any secret is
  written; external keys shown read-only; the panel refuses shared or proxied
  servers.
- Keyless capability responses for the optional HUD summary and place search.
- Aircraft-identity voice answers cover operator, type, and route, and say so
  plainly when enrichment is unavailable.
- README rewritten keyless-first; concise 0.1.0 changelog section; CI
  workflow included.

Gates: 2,672 unit tests pass / 0 fail, build clean, tracking regression
108/108, map-source tray QA pass, setup doctor ready.

.env.example

@@ -1,24 +1,26 @@
 # God's Eye View — environment variables
 # Copy to .env and fill in your keys. On macOS the launcher can also read keys
-# from the Keychain (see below); on Linux/Windows use this file or env vars.
+# from the Keychain (see README); on Linux/Windows use this file or env vars.
 #
-# macOS Keychain: store any of these and ./scripts/dev-fresh.sh pulls them in.
-# Each command prompts for the secret so it never lands in shell history:
-#   security add-generic-password -U -s "google-maps-api" -a "api-key" -w
-#   security add-generic-password -U -s "openai-api"      -a "api-key" -w
-#   security add-generic-password -U -s "aisstream-api"   -a "api-key" -w
-#   security add-generic-password -U -s "firms-map"       -a "map-key" -w
-#   security add-generic-password -U -s "cesium-ion"      -a "token"   -w
-#   security add-generic-password -U -s "tomtom-api"      -a "api-key" -w
+# Easiest path: don't edit anything. Run the app and paste keys into the
+# in-app Provider Settings panel (the POWER UP chip, bottom-right) — it writes
+# this checkout's .env for you (owner-only permissions) and restarts the dev
+# server. Under the Pinokio launcher it writes pinokio/ENVIRONMENT instead.
+# Keys you supply yourself (shell env, Keychain) are shown as configured
+# externally and never touched. This file remains the reference for headless
+# and self-hosted setups.
 #
 # NOTE ON CLIENT-EXPOSED KEYS: GOOGLE_MAPS_API_KEY and CESIUM_ION_TOKEN are
 # injected into the browser bundle by design (they're used client-side) and
 # WILL be visible in devtools. Restrict/scope them rather than trying to hide
 # them (see SECURITY.md). All other keys below stay server-side.
 
-# Required: Google Maps API key (Map Tiles API must be enabled).
+# Optional: direct Google Photorealistic 3D Tiles and GEV place search.
+# Without it, a Cesium ion token can still load ion-hosted Google 3D; with
+# neither credential, the app starts on keyless Esri World Imagery with OSM
+# available in the map tray and as the automatic provider-failure fallback.
 # CLIENT-EXPOSED — restrict it (HTTP referrer + API restriction) in Google Cloud.
-GOOGLE_MAPS_API_KEY=your_google_maps_api_key_here
+GOOGLE_MAPS_API_KEY=
 # Optional: opt-in per-IP rate limit for the Google Places cost endpoint
 # (/api/google/nearby-places), in requests per minute.
 # DEFAULT IS UNLIMITED — unset (or 0) means no throttling, unchanged behavior.
@@ -30,7 +32,10 @@ GOOGLE_MAPS_API_KEY=your_google_maps_api_key_here
 # (plus per-API quotas under APIs & Services -> Quotas).
 # GEV_RATELIMIT_GOOGLE_PER_MIN=60
 
-# Optional: Cesium ion token for Bing world imagery stacks and Cesium World Terrain.
+# Optional: Google Photorealistic 3D Tiles through Cesium ion, Bing world
+# imagery, and Cesium World Terrain. The free Community plan is for eligible
+# personal/non-commercial use and has quotas; check current Cesium terms. A
+# direct Google key above is still required for GEV place search.
 # CLIENT-EXPOSED — use a public assets:read token with URL restrictions.
 CESIUM_ION_TOKEN=
 
@@ -66,6 +71,10 @@ OPENSKY_AUTH_MODE=oauth
 OPENSKY_CLIENT_ID=
 OPENSKY_CLIENT_SECRET=
 
+# Optional: higher Launch Library 2 request allowance. Public access works
+# without a token.
+LL2_API_TOKEN=
+
 # Optional: OpenSky credentials JSON file path (alternative to above)
 # OPENSKY_CREDENTIALS_FILE=/path/to/credentials.json
 
@@ -113,8 +122,11 @@ AISSTREAM_API_KEY=
 # Keyless fallback: the traffic layer runs its built-in simulation (white dots,
 # hardcoded per-road-class speeds) — no key required for the layer to work.
 # TOMTOM_API_KEY=
-# Optional soft cap on upstream tile fetches per UTC day (default 40000).
-# Over the cap the proxy serves cached/stale tiles instead of hitting upstream.
+# Optional soft cap on upstream tile fetches per UTC day (default 40000) — a
+# configurable application safety ceiling, not a guarantee of staying within
+# TomTom's free allowance (currently 200K tile requests/month:
+# https://docs.tomtom.com/pricing/). Over the cap the proxy serves cached/stale
+# tiles instead of hitting upstream.
 # TOMTOM_DAILY_TILE_BUDGET=40000
 
 # Optional: CCTV layer tuning (advanced). Defaults are sensible — leave unset