Add ADS-B, AIS, and ALPR map layers with live CoT streaming.

Ingest aircraft and vessel tracks via OSINT feeds and tactical CoT, expose viewport-filtered SSE to the map, and add an OSM ALPR layer with tiled caching and performant marker sync.

docs/atak-itak.md

@@ -2,6 +2,8 @@
 
 KestrelOS acts as a **TAK Server**. ATAK (Android) and iTAK (iOS) connect on **port 8089** (CoT). Devices relay positions to each other and appear on the KestrelOS map.
 
+ADS-B and AIS via [adsbcot](https://github.com/snstac/adsbcot) / [aiscot](https://github.com/snstac/aiscot): see [tracking.md](tracking.md).
+
 ## Connection
 
 **Host:** KestrelOS hostname/IP  
@@ -59,7 +61,6 @@ OIDC users must set an **ATAK password** first:
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `COT_PORT` | `8089` | CoT server port |
-| `COT_TTL_MS` | `90000` | Device timeout (~90s) |
 | `COT_REQUIRE_AUTH` | `true` | Require authentication |
 | `COT_SSL_CERT` | `.dev-certs/cert.pem` | TLS cert path |
 | `COT_SSL_KEY` | `.dev-certs/key.pem` | TLS key path |

docs/map-and-cameras.md

@@ -5,6 +5,7 @@ KestrelOS shows a **map** with devices, POIs, live sessions (Share live), and AT
 ## Map Layers
 
 - **Devices** - Fixed feeds (IPTV, ALPR, CCTV, NVR, etc.) added via API
+- **ALPR (OSM / DeFlock)** - Crowdsourced license-plate cameras from OpenStreetMap; toggle on the map (camera icon control). Reference only, no stream.
 - **POIs** - Points of interest (admin/leader can edit)
 - **Live sessions** - Mobile devices streaming via Share live
 - **CoT (ATAK/iTAK)** - Amber markers for connected TAK devices (position only)
@@ -47,6 +48,15 @@ Stream URLs must be `http://` or `https://`.
 
 **Cameras endpoint:** `GET /api/cameras` returns devices + live sessions + CoT entities.
 
+## ALPR layer (DeFlock / OpenStreetMap)
+
+deflock.me has no bulk download API. KestrelOS queries OpenStreetMap via Overpass (`surveillance:type=ALPR`) and returns **GeoJSON FeatureCollection** from `GET /api/alpr`.
+
+- **Map:** ALPR layer is on by default (toggle top-left to hide). Marker popups show OSM identifying tags (manufacturer, model, operator, ref, Wikidata, etc.) when contributors tagged them.
+- **Offline:** Run `npm run import:alpr` to preload SQLite; cache serves automatically when Overpass is unreachable.
+
+Attribution: © OpenStreetMap contributors.
+
 ## POIs
 
 Admins/leaders add/edit from **POI** page (sidebar). POIs appear as map pins (reference only, no stream).

docs/tracking.md

@@ -0,0 +1,48 @@
+# ADS-B and AIS
+
+Aircraft and vessels use the same **CoT** store as ATAK/iTAK. The map consumes `GET /api/cot/stream` (SSE, viewport bbox). Toggle **Air**, **Surface**, and **Team** on the map.
+
+## Accuracy tiers
+
+1. **Tactical (best):** local SDR/AIS receiver → [adsbcot](https://github.com/snstac/adsbcot) / [aiscot](https://github.com/snstac/aiscot) → KestrelOS CoT `:8089` (sub-second updates).
+2. **Vessels (live OSINT):** AISStream WebSocket push as vessels transmit.
+3. **Aircraft (awareness OSINT):** OpenSky bbox poll — not a live stream; typical lag ~5s.
+
+For tactical use, run local receivers. Do not rely on OpenSky alone.
+
+## Freshness
+
+Tracks update via SSE `update` events (CoT `:8089`, AISStream) or coalesced `snapshot` after each OpenSky poll. Stale tracks are removed automatically (team ~90s, OSINT ~30s without a new fix).
+
+OSINT feeds run only while a map client is connected (SSE subscriber). Keep the map tab visible for live updates.
+
+## Self-hosted
+
+**ADS-B:** [adsbcot](https://github.com/snstac/adsbcot) → `tls://host:8089`
+
+```ini
+[adsbcot]
+COT_URL = tls://kestrelos.example.com:8089
+FEED_URL = tcp+beast://127.0.0.1:30005
+```
+
+**AIS:** [aiscot](https://github.com/snstac/aiscot) → `tls://host:8089`
+
+```ini
+[aiscot]
+COT_URL = tls://kestrelos.example.com:8089
+FEED_URL = tcp://127.0.0.1:10110
+```
+
+Use KestrelOS credentials (see [atak-itak.md](atak-itak.md)).
+
+## OSINT APIs (optional)
+
+Set these only if you want viewport OSINT without local receivers:
+
+| Variable | Purpose |
+|----------|---------|
+| `AISSTREAM_API_KEY` | AISStream WebSocket |
+| `OPENSKY_CLIENT_ID` / `OPENSKY_CLIENT_SECRET` | OpenSky OAuth (recommended for production) |
+
+UIDs: `ICAO.*` (ADS-B), `MMSI.*` (AIS). Icons follow CoT type (`a-f-A-*`, `a-f-S-*`, `a-f-G-*`).