Add ADS-B, AIS, and ALPR map layers with live CoT streaming (#36)

## Summary

- **ADS-B & AIS:** OpenSky and AISStream OSINT feeds upsert into the CoT store; tactical tracks still arrive via adsbcot/aiscot on `:8089`. Map clients subscribe via `GET /api/cot/stream` (SSE) with viewport bbox filtering and Air / Surface / Team layer toggles.
- **ALPR (Flock/OSM):** Toggleable license-plate reader layer sourced from OpenStreetMap, with SQLite cache, Overpass fallback, tiled viewport fetching, and clustered markers with direction cones.
- **Map performance:** Ring-based tile selection (fixes zoom-out crash), immutable tile cache, incremental marker sync, split cluster load/query, and padded SSE bbox to reduce reconnect churn.

## Docs

- `docs/tracking.md` — ADS-B/AIS accuracy tiers, freshness, self-hosted receivers, optional OSINT API keys
- `docs/map-and-cameras.md` — ALPR layer and map behavior updates

---------

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #36

test/integration/server-and-cot.spec.js

@@ -7,6 +7,7 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest'
 import { spawn, execSync } from 'node:child_process'
 import { connect } from 'node:tls'
+import { createServer } from 'node:net'
 import { existsSync, mkdirSync } from 'node:fs'
 import { join, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -21,11 +22,21 @@ const devCertsDir = join(projectRoot, '.dev-certs')
 const devKey = join(devCertsDir, 'key.pem')
 const devCert = join(devCertsDir, 'cert.pem')
 
-const API_PORT = 3000
-const COT_PORT = 8089
 const COT_AUTH_USER = 'test'
 const COT_AUTH_PASS = 'test'
 
+function getFreePort() {
+  return new Promise((resolve, reject) => {
+    const server = createServer()
+    server.listen(0, () => {
+      const address = server.address()
+      const port = typeof address === 'object' && address ? address.port : 0
+      server.close(() => resolve(port))
+    })
+    server.on('error', reject)
+  })
+}
+
 function ensureDevCerts() {
   if (existsSync(devKey) && existsSync(devCert)) return
   mkdirSync(devCertsDir, { recursive: true })
@@ -37,12 +48,12 @@ function ensureDevCerts() {
 
 const FETCH_TIMEOUT_MS = 5000
 
-async function waitForHealth(timeoutMs = 90000) {
+async function waitForHealth(apiPort, timeoutMs = 90000) {
   const start = Date.now()
   while (Date.now() - start < timeoutMs) {
     for (const protocol of ['https', 'http']) {
       try {
-        const baseURL = `${protocol}://localhost:${API_PORT}`
+        const baseURL = `${protocol}://localhost:${apiPort}`
         const ctrl = new AbortController()
         const t = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS)
         const res = await fetch(`${baseURL}/health`, { method: 'GET', signal: ctrl.signal })
@@ -55,16 +66,20 @@ async function waitForHealth(timeoutMs = 90000) {
     }
     await new Promise(r => setTimeout(r, 1000))
   }
-  throw new Error(`Health not OK on ${API_PORT} within ${timeoutMs}ms`)
+  throw new Error(`Health not OK on ${apiPort} within ${timeoutMs}ms`)
 }
 
 describe('Server and CoT integration', () => {
   const testState = {
     serverProcess: null,
+    apiPort: 0,
+    cotPort: 0,
   }
 
   beforeAll(async () => {
     ensureDevCerts()
+    testState.apiPort = await getFreePort()
+    testState.cotPort = await getFreePort()
     const serverPath = join(projectRoot, '.output', 'server', 'index.mjs')
     if (!existsSync(serverPath)) {
       execSync('npm run build', { cwd: projectRoot, stdio: 'pipe' })
@@ -72,6 +87,8 @@ describe('Server and CoT integration', () => {
     const dbPath = join(tmpdir(), `kestrelos-it-${process.pid}-${Date.now()}.db`)
     const env = {
       ...process.env,
+      PORT: String(testState.apiPort),
+      COT_PORT: String(testState.cotPort),
       DB_PATH: dbPath,
       BOOTSTRAP_EMAIL: COT_AUTH_USER,
       BOOTSTRAP_PASSWORD: COT_AUTH_PASS,
@@ -83,7 +100,7 @@ describe('Server and CoT integration', () => {
     })
     testState.serverProcess.stdout?.on('data', d => process.stdout.write(d))
     testState.serverProcess.stderr?.on('data', d => process.stderr.write(d))
-    await waitForHealth(90000)
+    await waitForHealth(testState.apiPort, 90000)
   }, 120000)
 
   afterAll(() => {
@@ -92,11 +109,11 @@ describe('Server and CoT integration', () => {
     }
   })
 
-  it('serves health on port 3000', async () => {
+  it('serves health on the configured API port', async () => {
     const tryProtocols = async (protocols) => {
       if (protocols.length === 0) throw new Error('No protocol succeeded')
       try {
-        const res = await fetch(`${protocols[0]}://localhost:${API_PORT}/health`, { method: 'GET', headers: { Accept: 'application/json' } })
+        const res = await fetch(`${protocols[0]}://localhost:${testState.apiPort}/health`, { method: 'GET', headers: { Accept: 'application/json' } })
         if (res?.ok) return res
         return tryProtocols(protocols.slice(1))
       }
@@ -112,10 +129,10 @@ describe('Server and CoT integration', () => {
     expect(body.endpoints).toHaveProperty('ready', '/health/ready')
   })
 
-  it('CoT on 8089: TAK client auth with username/password succeeds (socket stays open)', async () => {
+  it('CoT: TAK client auth with username/password succeeds (socket stays open)', async () => {
     const payload = buildAuthCotXml({ username: COT_AUTH_USER, password: COT_AUTH_PASS })
     const socket = await new Promise((resolve, reject) => {
-      const s = connect(COT_PORT, '127.0.0.1', { rejectUnauthorized: false }, () => {
+      const s = connect(testState.cotPort, '127.0.0.1', { rejectUnauthorized: false }, () => {
         s.write(payload, () => resolve(s))
       })
       s.on('error', reject)