Add ADS-B, AIS, and ALPR map layers with live CoT streaming (#36)

## Summary

- **ADS-B & AIS:** OpenSky and AISStream OSINT feeds upsert into the CoT store; tactical tracks still arrive via adsbcot/aiscot on `:8089`. Map clients subscribe via `GET /api/cot/stream` (SSE) with viewport bbox filtering and Air / Surface / Team layer toggles.
- **ALPR (Flock/OSM):** Toggleable license-plate reader layer sourced from OpenStreetMap, with SQLite cache, Overpass fallback, tiled viewport fetching, and clustered markers with direction cones.
- **Map performance:** Ring-based tile selection (fixes zoom-out crash), immutable tile cache, incremental marker sync, split cluster load/query, and padded SSE bbox to reduce reconnect churn.

## Docs

- `docs/tracking.md` — ADS-B/AIS accuracy tiers, freshness, self-hosted receivers, optional OSINT API keys
- `docs/map-and-cameras.md` — ALPR layer and map behavior updates

---------

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #36

server/api/alpr.get.js

@@ -0,0 +1,19 @@
+import { getDb } from '../utils/db.js'
+import { requireAuth } from '../utils/authHelpers.js'
+import { getAlprCameras, parseBbox } from '../utils/alpr.js'
+
+export default defineEventHandler(async (event) => {
+  requireAuth(event)
+  let bbox
+  try {
+    bbox = parseBbox(getQuery(event))
+  }
+  catch (error) {
+    throw createError({
+      statusCode: error?.statusCode || 400,
+      message: error?.message || 'invalid bbox',
+    })
+  }
+  const db = await getDb()
+  return getAlprCameras(db, bbox)
+})

server/api/cameras.get.js

@@ -1,19 +1,15 @@
 import { getDb } from '../utils/db.js'
 import { requireAuth } from '../utils/authHelpers.js'
 import { getActiveSessions } from '../utils/liveSessions.js'
-import { getActiveEntities } from '../utils/cotStore.js'
 import { rowToDevice, sanitizeDeviceForResponse } from '../utils/deviceUtils.js'
 
 export default defineEventHandler(async (event) => {
   requireAuth(event)
-  const config = useRuntimeConfig()
-  const ttlMs = Number(config.cotTtlMs ?? 90_000) || 90_000
-  const [db, sessions, cotEntities] = await Promise.all([
+  const [db, sessions] = await Promise.all([
     getDb(),
     getActiveSessions(),
-    getActiveEntities(ttlMs),
   ])
   const rows = await db.all('SELECT id, name, device_type, vendor, lat, lng, stream_url, source_type, config FROM devices ORDER BY id')
   const devices = rows.map(rowToDevice).filter(Boolean).map(sanitizeDeviceForResponse)
-  return { devices, liveSessions: sessions, cotEntities }
+  return { devices, liveSessions: sessions }
 })

server/api/cot/stream.get.js

@@ -0,0 +1,45 @@
+import { createEventStream } from 'h3'
+import { requireAuth } from '../../utils/authHelpers.js'
+import { getActiveEntitiesInBbox } from '../../utils/cotStore.js'
+import { registerSubscriber } from '../../utils/cotSubscribers.js'
+import { getCotSnapshotOpts } from '../../utils/cotSnapshot.js'
+import { COT_SSE_HEARTBEAT_MS } from '../../utils/constants.js'
+import { parseBboxParam, parseLayersParam } from '../../utils/cotEntityUtils.js'
+import { scheduleTrackingFeedRefresh } from '../../utils/trackingFeed.js'
+
+export default defineEventHandler((event) => {
+  requireAuth(event)
+  const query = getQuery(event)
+  const bbox = parseBboxParam(typeof query.bbox === 'string' ? query.bbox : undefined)
+  const layers = parseLayersParam(typeof query.layers === 'string' ? query.layers : undefined)
+  const snapshotOpts = getCotSnapshotOpts()
+
+  const stream = createEventStream(event)
+
+  const push = (eventName, data) => stream.push({ event: eventName, data })
+
+  const sendSnapshot = async () => {
+    const entities = await getActiveEntitiesInBbox(bbox, { ...snapshotOpts, layers })
+    await push('snapshot', JSON.stringify({ entities }))
+  }
+
+  const unregister = registerSubscriber({ bbox, layers, push })
+
+  let heartbeat
+
+  stream.onClosed(async () => {
+    clearInterval(heartbeat)
+    unregister()
+    scheduleTrackingFeedRefresh()
+  })
+
+  void (async () => {
+    scheduleTrackingFeedRefresh()
+    await sendSnapshot()
+    heartbeat = setInterval(() => {
+      push('heartbeat', '{}').catch(() => {})
+    }, COT_SSE_HEARTBEAT_MS)
+  })()
+
+  return stream.send()
+})