docs(street-level): the proxy adds the token to tile requests and refuses redirects

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/CURRENT-STATE.md

@@ -3045,10 +3045,11 @@ reads KEY REQUIRED, says which key to add and disables the filters; a rejected
 key reads KEY REJECTED and stops tile requests until the layer goes off; a 429
 pauses them for its Retry-After.
 
-The server proxy (`server/providers/mapillary.js`) keeps the token server-side,
-serves only z11–14 coverage, refuses upstream redirects, strips the unused
-`image` layer, coalesces concurrent requests and keeps tiles in a 24 h memory
-cache.
+The server proxy (`server/providers/mapillary.js`) adds the token to
+coverage-tile requests (the browser holds it too, for MapillaryJS and the Graph
+API), serves only z11–14 coverage, refuses upstream redirects, strips the
+unused `image` layer, coalesces concurrent requests, runs at most six Mapillary
+fetches at once and keeps tiles in a 24 h memory cache.
 
 MapillaryJS loads on the first photo. Opening one frames it with a single
 camera flight through the application's deferred navigation (`begin` /