fix(osm): gate place search cross-site and share its slots fairly

From review:
- /api/osm/features now refuses cross-site browser requests like the other
  quota-bearing routes, so a page elsewhere cannot spend the operator's
  Overpass. SECURITY.md lists the route, its limits and its disk cache.
- One client runs one search at a time and two run at once in all, instead
  of one global slot any single client could hold.
- A search gets 45 s across every configured endpoint in turn, answered 504
  when it runs out.
- A cache write no longer waits on the disk prune; prune() waits until the
  cache is idle for callers that need it.

server/providers/overpass/osmFeatures.js

@@ -32,6 +32,8 @@ export const OSM_FEATURE_LIMITS = Object.freeze({
   maxResponseBytes: 16 * 1024 * 1024,
   /** Per-upstream wait: a busy Overpass answers these in 10–30 s. */
   upstreamTimeoutMs: 40_000,
+  /** The whole search, across every configured endpoint in turn. */
+  upstreamBudgetMs: 45_000,
 });
 
 /** Tags a returned feature keeps, besides the preset's own. */