Add OpenSeaMap / OpenSnowMap overlay layers (#10)

Two independently toggleable open-data raster overlays — OpenSeaMap
sea marks (buoys, lighthouses, ports) and OpenSnowMap ski pistes —
drawn as Cesium.ImageryLayers directly on the Cesium globe surface.
Same "small array of descriptors" shape as MAP_STACKS in
mapStackController.js.

Visible on the osm/bing-aerial/bing-labels map stacks and invisible
(not broken — the layer's stats say so in plain text) on the default
photoreal stack, since Google Photorealistic 3D Tiles render with the
globe hidden.

OpenRailwayMap and OpenInfraMap, also requested in #10, are
deliberately NOT included in this pass: OpenRailwayMap's public tile
server enforces a Referer allowlist scoped to its own site (confirmed
by direct request — every other Referer, including none, 403s), and
OpenInfraMap serves MapLibre GL vector tiles, not raster XYZ — that
would need a genuine vector-tile rendering pipeline, not a
Cesium.ImageryLayer drop-in. Worth its own dedicated pass.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

DATA_SOURCES.md

@@ -37,10 +37,13 @@ How to read this:
 | **GBFS (Lyft / BCycle)** | Bikeshare availability | Per-feed (attribution-only) | Credit the operator (e.g. Austin BCycle) + its `license_url` |
 | **Radio Browser** | Geolocated internet-radio station directory and station-level tags | Public-domain directory data under PDDL 1.0; individual broadcaster stream terms apply | "Radio Browser" plus a link to the selected broadcaster |
 | **Re:Earth Terrain** (Mapterhorn) | Terrain (keyless globe stacks — OSM etc. — + `/api/terrain/heights` ellipsoidal-height lookups) | Terrain mesh: CC BY 4.0; geoid: EGM2008 (NGA, public domain) | "Terrain (keyless globe stacks): Re:Earth Terrain / Mapterhorn (CC BY 4.0) / EGM2008 (NGA)" |
+| **OpenSeaMap** (`tiles.openseamap.org`) | Sea marks raster overlay (buoys, lighthouses, ports) — one of two Open Map Overlays (#10) | Map data ODbL 1.0 via OpenStreetMap | "© OpenSeaMap contributors" |
+| **OpenSnowMap** (`opensnowmap.org`) | Ski piste raster overlay — one of two Open Map Overlays (#10) | Map data ODbL 1.0 (OpenStreetMap) + SRTM; map style CC BY-SA | "Map data: © OpenStreetMap contributors, SRTM \| Map style: © OpenSnowMap.org (CC-BY-SA)" |
 
 ### Notes on the live sources
 
 - **Google Maps Platform.** You supply your own API key and are bound by [Google's ToS](https://cloud.google.com/maps-platform/terms). Google Maps Content (tiles, geocodes, places) **may not be cached, stored, rehosted, or committed** — this app only ever uses it live, which is the compliant pattern. The "Google" attribution is displayed on the globe and must stay visible. Restrict your key (see [SECURITY.md](SECURITY.md)).
+- **Open Map Overlays (#10).** Two independently toggleable keyless raster overlays — OpenSeaMap sea marks and OpenSnowMap ski pistes — drawn as `Cesium.ImageryLayer`s directly on the Cesium globe surface. Like every globe-surface source, they render on the `osm`/`bing-aerial`/`bing-labels` map stacks and are invisible on the default `photoreal` stack (Google Photorealistic 3D Tiles render with the globe hidden; see `mapStackController.js`) — the layer's stats surface that as plain text instead of looking broken. OpenRailwayMap and OpenInfraMap, also requested in #10, are not included: OpenRailwayMap's public tile server enforces a Referer allowlist restricted to its own site (confirmed by direct request — any other Referer, including none, 403s), and OpenInfraMap serves MapLibre vector tiles rather than raster XYZ tiles, which would need a genuine vector-tile rendering pipeline, not an imagery-layer drop-in.
 - **OpenSky Network.** Its license is **non-commercial**, and operational use of the REST API in a live product can require a prior written agreement with OpenSky — even for non-profit/government use. If you deploy this commercially, contact OpenSky for your own terms. The flights layer is a toggle and runs anonymously by default.
 - **adsb.lol flight fallback.** When OpenSky is unavailable and no last-good OpenSky response exists, the server requests a cached, capped 250 nm adsb.lol point snapshot around the current camera subpoint. This is regional observed context, not worldwide completeness; provenance is exposed in the Flights stats/context row. Military ICAOs remain reconciled through the existing dedicated military registry rather than duplicated.
 - **Launch Library 2.** `/api/launches` makes a server-side rolling-30-day query against the supported v2.3 detailed launch endpoint, caches successful responses for 15 minutes in memory and on disk, and serves the last successful response during a throttle or transient outage. Anonymous access is limited to 15 calls/hour; deployments can provide `LL2_API_TOKEN` for authenticated access. The Space Devs' published terms permit using and sharing the API data in any form, ask users not to forward it without adding value, disclaim complete accuracy, and encourage—but do not require—attribution. This app keeps a courtesy credit. Payload and stage/recovery records are shown only when supplied. Failed launches expose their source status and never receive fallback orbit geometry or a live/estimated marker. LL2 supplies launch context and event timing, not continuous ascent telemetry or live orbital state.