Add ADS-B, AIS, and ALPR map layers with live CoT streaming (#36)

## Summary

- **ADS-B & AIS:** OpenSky and AISStream OSINT feeds upsert into the CoT store; tactical tracks still arrive via adsbcot/aiscot on `:8089`. Map clients subscribe via `GET /api/cot/stream` (SSE) with viewport bbox filtering and Air / Surface / Team layer toggles.
- **ALPR (Flock/OSM):** Toggleable license-plate reader layer sourced from OpenStreetMap, with SQLite cache, Overpass fallback, tiled viewport fetching, and clustered markers with direction cones.
- **Map performance:** Ring-based tile selection (fixes zoom-out crash), immutable tile cache, incremental marker sync, split cluster load/query, and padded SSE bbox to reduce reconnect churn.

## Docs

- `docs/tracking.md` — ADS-B/AIS accuracy tiers, freshness, self-hosted receivers, optional OSINT API keys
- `docs/map-and-cameras.md` — ALPR layer and map behavior updates

---------

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #36

test/unit/constants.spec.js

@@ -2,7 +2,10 @@ import { describe, it, expect } from 'vitest'
 import {
   COT_AUTH_TIMEOUT_MS,
   LIVE_SESSION_TTL_MS,
+  COT_TTL_MS,
   COT_ENTITY_TTL_MS,
+  COT_OSINT_TTL_MS,
+  COT_PRUNE_INTERVAL_MS,
   POLL_INTERVAL_MS,
   SHUTDOWN_TIMEOUT_MS,
   COT_PORT,
@@ -18,7 +21,10 @@ describe('constants', () => {
   it('uses default values when env vars not set', () => {
     expect(COT_AUTH_TIMEOUT_MS).toBe(15000)
     expect(LIVE_SESSION_TTL_MS).toBe(60000)
+    expect(COT_TTL_MS).toBe(90000)
     expect(COT_ENTITY_TTL_MS).toBe(90000)
+    expect(COT_OSINT_TTL_MS).toBe(30000)
+    expect(COT_PRUNE_INTERVAL_MS).toBe(15000)
     expect(POLL_INTERVAL_MS).toBe(1500)
     expect(SHUTDOWN_TIMEOUT_MS).toBe(30000)
     expect(COT_PORT).toBe(8089)