fix: keep the globe on screen when zooming out from a tilted view

Cesium zooms a shallow view out by backing along the cursor ray with
heading and pitch held fixed, and GEV set no zoom ceiling. Past ~700 km
the limb drops below the fixed pitch, the steps grow with height, and
the camera flies off into space.

Cap user zoom at 40,000 km (whole-Earth view; flights are not limited)
and, above 300 km during a user wheel, pinch or right-drag zoom-out,
ease the pitch down to at least 8 degrees below the Earth's limb. The
clamp yields to disabled inputs, tracked transforms and camera flights.

docs/CURRENT-STATE.md

@@ -44,6 +44,14 @@ pinching traverses globe and street scales with fewer gestures. Cesium retains
 its distance-aware zoom, collision handling and minimum/maximum distance limits.
 Fine-pointer desktop mouse and trackpad sensitivity is unchanged.
 
+User zoom stops at 40,000 km above the surface, a whole-Earth view; camera
+flights, share links and story views are not limited. Above 300 km, a
+wheel, pinch or right-drag zoom-out from a shallow, tilted view pitches the
+camera down as it climbs, keeping the view at least 8° below the Earth's limb,
+so the globe stays on screen instead of sliding off into space. Oblique views
+below 300 km, zooming in, tilting by drag, tracked entities, cockpit tracking
+and camera flights are left alone.
+
 Analyst region queries resolve unique Natural Earth names offline without
 geocoding, so Gold Coast and Ivory Coast name the West African natural regions.
 Duplicate names require a geocoded containment anchor; when several entries for