Merge main into PR #621 (ChatGPT OAuth for Realtime voice)

Resolve conflicts with the voice-core captions, panel resize and MCP
panel key changes by keeping both sides.

.env.example

@@ -13,9 +13,9 @@
 # externally and never touched. This file remains the reference for headless
 # and self-hosted setups.
 #
-# NOTE ON CLIENT-EXPOSED KEYS: GOOGLE_MAPS_API_KEY and CESIUM_ION_TOKEN are
-# injected into the browser bundle by design (they're used client-side) and
-# WILL be visible in devtools. Restrict/scope them rather than trying to hide
+# NOTE ON CLIENT-EXPOSED KEYS: GOOGLE_MAPS_API_KEY, CESIUM_ION_TOKEN and
+# MAPILLARY_CLIENT_TOKEN are injected into the browser bundle by design
+# (they're used client-side) and WILL be visible in devtools. Restrict/scope them rather than trying to hide
 # them (see SECURITY.md). All other keys below stay server-side.
 
 # Optional: direct Google Photorealistic 3D Tiles and GEV place search.
@@ -73,6 +73,14 @@ OPENAI_REALTIME_REASONING_EFFORT=low
 # Keep only a short conversational window. Current map state is fetched live.
 OPENAI_REALTIME_CONTEXT_TOKENS=3000
 OPENAI_REALTIME_CONTEXT_RETENTION=0.5
+# Voice-card captions of what you said. Billed separately by OpenAI and
+# counted in the session cost meter and cap; off disables them.
+OPENAI_REALTIME_TRANSCRIBE_MODEL=gpt-4o-mini-transcribe
+# The voice debug log (.gev-logs/realtime-conversations.jsonl, rotated at
+# 32 MB, never expired) omits transcripts, typed or spoken text, and tool
+# arguments/results (including serialized outputs) by default. Set to 1 to
+# keep them while debugging; delete the log when you are done.
+GEV_VOICE_LOG_CONTENT=
 OPENAI_HUD_SUMMARY_MODEL=gpt-5-nano
 # Per-IP rate limit for the OpenAI cost endpoints
 # (/api/realtime/token + /api/openai/hud-summary), in requests per minute.
@@ -88,6 +96,11 @@ OPENAI_HUD_SUMMARY_MODEL=gpt-5-nano
 # Limits (usage limits).
 # GEV_RATELIMIT_OPENAI_PER_MIN=30   # the default; uncomment only to change it
 
+# Optional: Mapillary imagery for the Street Level layer. Free client token from
+# https://www.mapillary.com/dashboard/developers (register an app, copy its
+# Client Token). Client-exposed by design, like GOOGLE_MAPS_API_KEY.
+MAPILLARY_CLIENT_TOKEN=
+
 # Optional: OpenSky auth mode (oauth | basic | auto | anon)
 # Default: oauth — requires client credentials below
 # Set to "anon" to skip aircraft auth (rate-limited but works)