Add ADS-B, AIS, and ALPR map layers with live CoT streaming (#36)

## Summary

- **ADS-B & AIS:** OpenSky and AISStream OSINT feeds upsert into the CoT store; tactical tracks still arrive via adsbcot/aiscot on `:8089`. Map clients subscribe via `GET /api/cot/stream` (SSE) with viewport bbox filtering and Air / Surface / Team layer toggles.
- **ALPR (Flock/OSM):** Toggleable license-plate reader layer sourced from OpenStreetMap, with SQLite cache, Overpass fallback, tiled viewport fetching, and clustered markers with direction cones.
- **Map performance:** Ring-based tile selection (fixes zoom-out crash), immutable tile cache, incremental marker sync, split cluster load/query, and padded SSE bbox to reduce reconnect churn.

## Docs

- `docs/tracking.md` — ADS-B/AIS accuracy tiers, freshness, self-hosted receivers, optional OSINT API keys
- `docs/map-and-cameras.md` — ALPR layer and map behavior updates

---------

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #36

docs/atak-itak.md

@@ -2,6 +2,8 @@
 
 KestrelOS acts as a **TAK Server**. ATAK (Android) and iTAK (iOS) connect on **port 8089** (CoT). Devices relay positions to each other and appear on the KestrelOS map.
 
+ADS-B and AIS via [adsbcot](https://github.com/snstac/adsbcot) / [aiscot](https://github.com/snstac/aiscot): see [tracking.md](tracking.md).
+
 ## Connection
 
 **Host:** KestrelOS hostname/IP  
@@ -59,7 +61,6 @@ OIDC users must set an **ATAK password** first:
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `COT_PORT` | `8089` | CoT server port |
-| `COT_TTL_MS` | `90000` | Device timeout (~90s) |
 | `COT_REQUIRE_AUTH` | `true` | Require authentication |
 | `COT_SSL_CERT` | `.dev-certs/cert.pem` | TLS cert path |
 | `COT_SSL_KEY` | `.dev-certs/key.pem` | TLS key path |