Add ADS-B, AIS, and ALPR map layers with live CoT streaming (#36)

## Summary

- **ADS-B & AIS:** OpenSky and AISStream OSINT feeds upsert into the CoT store; tactical tracks still arrive via adsbcot/aiscot on `:8089`. Map clients subscribe via `GET /api/cot/stream` (SSE) with viewport bbox filtering and Air / Surface / Team layer toggles.
- **ALPR (Flock/OSM):** Toggleable license-plate reader layer sourced from OpenStreetMap, with SQLite cache, Overpass fallback, tiled viewport fetching, and clustered markers with direction cones.
- **Map performance:** Ring-based tile selection (fixes zoom-out crash), immutable tile cache, incremental marker sync, split cluster load/query, and padded SSE bbox to reduce reconnect churn.

## Docs

- `docs/tracking.md` — ADS-B/AIS accuracy tiers, freshness, self-hosted receivers, optional OSINT API keys
- `docs/map-and-cameras.md` — ALPR layer and map behavior updates

---------

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #36

test/unit/cotServer.spec.js

@@ -44,4 +44,17 @@ describe('cotServer (parse-and-store path)', () => {
     expect(active[0].lng).toBe(4)
     expect(active[0].label).toBe('Updated')
   })
+
+  it('infers adsb source from ICAO uid when ingesting CoT position', async () => {
+    await updateFromCot({
+      id: 'ICAO.abc123',
+      lat: 37.7,
+      lng: -122.4,
+      label: 'N12345',
+      eventType: 'a-f-A-C-F',
+    })
+    const active = await getActiveEntities()
+    expect(active[0].source).toBe('adsb')
+    expect(active[0].type).toBe('a-f-A-C-F')
+  })
 })