Add ADS-B, AIS, and ALPR map layers with live CoT streaming (#36)

## Summary

- **ADS-B & AIS:** OpenSky and AISStream OSINT feeds upsert into the CoT store; tactical tracks still arrive via adsbcot/aiscot on `:8089`. Map clients subscribe via `GET /api/cot/stream` (SSE) with viewport bbox filtering and Air / Surface / Team layer toggles.
- **ALPR (Flock/OSM):** Toggleable license-plate reader layer sourced from OpenStreetMap, with SQLite cache, Overpass fallback, tiled viewport fetching, and clustered markers with direction cones.
- **Map performance:** Ring-based tile selection (fixes zoom-out crash), immutable tile cache, incremental marker sync, split cluster load/query, and padded SSE bbox to reduce reconnect churn.

## Docs

- `docs/tracking.md` — ADS-B/AIS accuracy tiers, freshness, self-hosted receivers, optional OSINT API keys
- `docs/map-and-cameras.md` — ALPR layer and map behavior updates

---------

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #36

test/unit/cotStore.spec.js

@@ -1,5 +1,12 @@
 import { describe, it, expect, beforeEach } from 'vitest'
-import { updateFromCot, getActiveEntities, clearCotStore } from '../../../server/utils/cotStore.js'
+import {
+  updateFromCot,
+  getActiveEntities,
+  getActiveEntitiesInBbox,
+  clearCotStore,
+  onCotChange,
+  pruneStaleEntities,
+} from '../../../server/utils/cotStore.js'
 
 describe('cotStore', () => {
   beforeEach(() => {
@@ -14,6 +21,28 @@ describe('cotStore', () => {
     expect(active[0].lat).toBe(37.7)
     expect(active[0].lng).toBe(-122.4)
     expect(active[0].label).toBe('Alpha')
+    expect(active[0].source).toBe('tak')
+  })
+
+  it('stores enriched ADS-B fields and infers source', async () => {
+    await updateFromCot({
+      id: 'ICAO.abc123',
+      lat: 37.7,
+      lng: -122.4,
+      label: 'UAL1',
+      type: 'a-f-A-C-F',
+      heading: 90,
+      speed: 200,
+      altitude: 10000,
+    })
+    const active = await getActiveEntities()
+    expect(active[0]).toMatchObject({
+      source: 'adsb',
+      heading: 90,
+      speed: 200,
+      altitude: 10000,
+      type: 'a-f-A-C-F',
+    })
   })
 
   it('updates same uid', async () => {
@@ -41,10 +70,10 @@ describe('cotStore', () => {
 
   it('prunes expired entities after getActiveEntities', async () => {
     await updateFromCot({ id: 'uid-1', lat: 37, lng: -122 })
-    const active1 = await getActiveEntities(100)
+    const active1 = await getActiveEntities({ ttlMs: 100 })
     expect(active1).toHaveLength(1)
     await new Promise(r => setTimeout(r, 150))
-    const active2 = await getActiveEntities(100)
+    const active2 = await getActiveEntities({ ttlMs: 100 })
     expect(active2).toHaveLength(0)
   })
 
@@ -55,4 +84,56 @@ describe('cotStore', () => {
     expect(active).toHaveLength(2)
     expect(active.map(e => e.id).sort()).toEqual(['a', 'b'])
   })
+
+  it('filters OSINT entities by bbox but keeps team globally', async () => {
+    await updateFromCot({ id: 'ICAO.abc', lat: 37.5, lng: -122.5, type: 'a-f-A-C-F' })
+    await updateFromCot({ id: 'MMSI.123', lat: 40, lng: -100, type: 'a-f-S-C' })
+    await updateFromCot({ id: 'ANDROID-1', lat: 50, lng: 10, source: 'tak' })
+    const bbox = { west: -123, south: 37, east: -122, north: 38 }
+    const active = await getActiveEntitiesInBbox(bbox, { takFilterBbox: false })
+    const ids = active.map(e => e.id).sort()
+    expect(ids).toEqual(['ANDROID-1', 'ICAO.abc'])
+  })
+
+  it('filters team by bbox when COT_TAK_FILTER_BBOX enabled', async () => {
+    await updateFromCot({ id: 'ANDROID-1', lat: 50, lng: 10, source: 'tak' })
+    const bbox = { west: -123, south: 37, east: -122, north: 38 }
+    const active = await getActiveEntitiesInBbox(bbox, { takFilterBbox: true })
+    expect(active).toHaveLength(0)
+  })
+
+  it('caps bbox query results at maxEntities', async () => {
+    for (let i = 0; i < 5; i++) {
+      await updateFromCot({ id: `ICAO.${i}`, lat: 37.5 + i * 0.01, lng: -122.4, type: 'a-f-A-C-F' })
+    }
+    const bbox = { west: -123, south: 37, east: -122, north: 38 }
+    const active = await getActiveEntitiesInBbox(bbox, { maxEntities: 3 })
+    expect(active).toHaveLength(3)
+  })
+
+  it('skips emit when silent upsert', async () => {
+    const updates = []
+    const off = onCotChange((event) => {
+      if (event === 'update') updates.push(event)
+    })
+    await updateFromCot({ id: 'ICAO.silent', lat: 37, lng: -122, type: 'a-f-A-C-F' }, { silent: true })
+    off()
+    expect(updates).toHaveLength(0)
+    const active = await getActiveEntities()
+    expect(active.some(e => e.id === 'ICAO.silent')).toBe(true)
+  })
+
+  it('pruneStaleEntities uses shorter TTL for OSINT sources', async () => {
+    await updateFromCot({ id: 'ICAO.old', lat: 37, lng: -122, source: 'adsb', type: 'a-f-A-C-F' })
+    await updateFromCot({ id: 'ANDROID-1', lat: 37, lng: -122, source: 'tak' })
+    const removed = []
+    const off = onCotChange((event, payload) => {
+      if (event === 'remove') removed.push(payload.id)
+    })
+    await new Promise(r => setTimeout(r, 60))
+    await pruneStaleEntities({ ttlMs: 10_000, osintTtlMs: 50 })
+    off()
+    expect(removed).toContain('ICAO.old')
+    expect(removed).not.toContain('ANDROID-1')
+  })
 })