fix(street-level): Panoramax functional QA — nearest lookup, line cap order, hostile data

From an adversarial functional QA round against the live API:
- The nearest lookup missed pictures looking away from the click
  (place_position leaves them out at any tolerance): it now runs a
  bounding-box search beside it and ranks both by distance. A line
  clicked from high up searches its sequence within height / 100
  (50–400 m).
- The per-tile line cap kept the newest sequences, not the longest
  (lineCoverage re-sorted them): providers can now keep their decoded
  order (`keepOrder`).
- A long producer name froze the tab (quadratic email regex): linear
  check. A malformed link escape no longer fails the lookup; null or
  string coordinates no longer land at 0,0.
- A line with no camera type or day stays drawn under the filters.
- A sky click on a line changes nothing (as KartaView), instead of
  selecting a sequence with no cones.
- An unreadable tile reads as such; a failed neighbour z15 tile only
  thins the cones; unknown or refused ids say the picture is gone.
- Shared viewer: the sharp-panorama guard is per open (a late download
  of the previous photo no longer lets a second one start); an HD-only
  360° picture is shrunk or skipped like any original; panorama.js read
  the bitmap size after closing it, so 2:1 power-of-two panoramas
  clamped instead of wrapping.
- Tests for each, and for the gaps mutation testing found (preferred
  point, cone order, no reload within drawn tiles, newest-first gate,
  stale bitmap release, flat upgrade retry).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/tooling/streetLevelQa.test.mjs

@@ -755,12 +755,10 @@ test('Panoramax fixtures: two sequences on one street, searches honour sequence
     panoramaxTile,
     resetPanoramaxFixture,
   } = await import('../../scripts/fixtures/street-level/panoramax.mjs');
-  const { decodeCoverageTile, decodePictures } = await import(
-    '../layers/streetLevel/providers/panoramax/decode.js'
-  );
-  const { normalizeItem } = await import(
-    '../layers/streetLevel/providers/panoramax/policy.js'
-  );
+  const { decodeCoverageTile, decodePictures } =
+    await import('../layers/streetLevel/providers/panoramax/decode.js');
+  const { normalizeItem } =
+    await import('../layers/streetLevel/providers/panoramax/policy.js');
   resetPanoramaxFixture();
   const pictures = panoramaxPictures();
   assert.deepEqual(