Read API paths and forwarded requests as the router does

The router reads an absolute-form target's path without resolving dot
segments, so a target such as http://host/api/../x still reaches /api
middleware. Take that path the same way when deciding whether the API
response headers apply.

The Street View fallback now treats any forwarding header as forwarded, even
an empty one, before it spends the key.

server/providers/cctv.js

@@ -20,7 +20,7 @@ import {
 } from './cctv/constants.js';
 import { sanitizeCctvRangeHeader } from './cctv/range.js';
 import { admitSameSiteKeyless } from './common/same-site.js';
-import { hasProxySignals } from '../../src/localRequestGate.mjs';
+import { PROXY_SIGNALS } from '../../src/localRequestGate.mjs';
 import { createHlsPuller } from './cctv/stream.js';
 import { googleServerApiKey } from './places/google-key.js';
 export { CCTV_FRAME_FETCH_TIMEOUT_MS, fetchCctvImageFromUpstream };
@@ -551,8 +551,12 @@ export function cctvProxy({ sourceRoot = process.cwd() } = {}) {
 
         // The Street View fallback spends the Google key, so a forwarded
         // request (whose client this server cannot see) gets the placeholder,
-        // as if no key were configured.
-        const sv = hasProxySignals(req.headers || {})
+        // as if no key were configured. Any forwarding header counts, even an
+        // empty one.
+        const forwarded = PROXY_SIGNALS.some(
+          (name) => req.headers?.[name] !== undefined,
+        );
+        const sv = forwarded
           ? null
           : await streetViewFallback({
               lat,