fix: call OpenSky API directly from browser to bypass Vercel IP blocks (#1)

* fix: switch flights API to edge runtime, lower timeouts

- Switch to Edge Runtime (30s timeout on ALL Vercel plans, near-zero cold starts)
- Lower FETCH_TIMEOUT_MS from 20s to 8s (prevents Vercel killing the function)
- Lower TOKEN_TIMEOUT_MS from 5s to 3s
- Replace Buffer.from() with btoa() for edge compatibility
- Remove maxDuration (not needed for edge functions)

Fixes 502 Bad Gateway on Vercel deployments caused by Hobby plan's
10s function timeout being exceeded by the 20s fetch timeout.

* fix: revert edge runtime, keep reduced timeouts

Edge runtime caused 500 on Vercel. Reverted to Node.js serverless
with reduced timeouts only:
- FETCH_TIMEOUT_MS: 20s -> 8s
- TOKEN_TIMEOUT_MS: 5s -> 3s
- Restored Buffer.from() for basic auth

* fix: handle DOMException unavailability in Vercel runtime

- Fix TypeError: 'Right-hand side of instanceof is not an object'
  caused by DOMException not existing in Vercel's server runtime
- Use safe abort detection: check err.name === 'AbortError' on Error
  first, then conditionally check DOMException if available
- Restore TOKEN_TIMEOUT_MS to 5s (3s was too aggressive from Vercel)
- Keep FETCH_TIMEOUT_MS at 8s (down from original 20s)

* fix: deploy to Frankfurt, increase timeouts, add retry logic

- Set preferredRegion to 'fra1' (Frankfurt) — closest to OpenSky EU servers
- Increase FETCH_TIMEOUT_MS to 15s and TOKEN_TIMEOUT_MS to 8s
  (OpenSky is slow from cloud IPs, needs more time)
- Add retry logic: 1 retry with 500ms delay before giving up
- Keep safe DOMException handling for Vercel runtime compat

* feat: add Railway proxy for OpenSky API, proxy mode for Vercel route

OpenSky blocks/throttles requests from Vercel's IP ranges. This adds:

1. **Railway proxy** (`proxy/`) — standalone Node.js server that handles
   OpenSky API calls with auth, caching, and CORS. Zero dependencies.

2. **Proxy mode in Vercel route** — when OPENSKY_PROXY_URL env var is set,
   the Vercel /api/flights route forwards requests to the Railway proxy
   instead of calling OpenSky directly.

Setup:
- Deploy proxy/ to Railway with OPENSKY credentials
- Set OPENSKY_PROXY_URL in Vercel to the Railway URL
- Remove OPENSKY credentials from Vercel (only needed on Railway)

* refactor: call OpenSky directly from browser, remove server-side proxy

OpenSky supports CORS (Access-Control-Allow-Origin: *), so we can
call the API directly from the user's browser. This bypasses
Vercel's cloud-provider IPs that OpenSky blocks.

Changes:
- opensky.ts: fetch from opensky-network.org/api directly (was /api/flights)
- use-flights.ts: fix DOMException abort detection
- Remove src/app/api/flights/route.ts (server-side proxy)
- Remove proxy/ directory (Railway proxy)

The app is now fully static — no server-side API routes needed.

* chore: remove server-side API route (now browser-side)

* chore: remove Railway proxy (no longer needed)

* chore: remove proxy package.json

* chore: remove proxy README

* polish: production-grade cleanup, security hardening, remove redundant comments

- Remove redundant JSDoc blocks in opensky.ts, keep only @see link
- Add bounds-clamping for lat/lng parameters (defense-in-depth)
- Fix memory leak: map.on("movestart") listener now cleaned up on unmount
- Validate GA_ID format before interpolating into script tag (XSS defense)
- Remove duplicate canonical <link> tag (already set via metadata.alternates)
- Sanitize JSON-LD output with \u003c escaping to prevent </script> injection
- Use useRef instead of useState for mutable TrailStore class instance
- Fix unused useState import in use-trail-history
- Add Map.displayName for React DevTools
- Fix Tailwind lint: px-[2px] → px-0.5
- Remove unused OPENSKY credentials from .env.example

* chore: push remaining polished files (flight-tracker, use-flights, map)

- flight-tracker: movestart listener cleanup on unmount
- use-flights: clean up redundant comments, fix abort detection
- map: add displayName, remove redundant comment prefix

* chore: polish control-panel (clean comments, Tailwind lint fix)

src/hooks/use-trail-history.ts

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState, useMemo } from "react";
+import { useRef, useMemo } from "react";
 import type { FlightState } from "@/lib/opensky";
 
 type Position = [lng: number, lat: number];
@@ -32,7 +32,6 @@ function catmullRomSmooth(
     const p2 = points[i + 1];
     const p3 = points[Math.min(points.length - 1, i + 2)];
 
-    // Knot intervals
     const d01 = Math.pow(Math.hypot(p1[0] - p0[0], p1[1] - p0[1]), 0.5) || 1e-6;
     const d12 = Math.pow(Math.hypot(p2[0] - p1[0], p2[1] - p1[1]), 0.5) || 1e-6;
     const d23 = Math.pow(Math.hypot(p3[0] - p2[0], p3[1] - p2[1]), 0.5) || 1e-6;
@@ -45,7 +44,6 @@ function catmullRomSmooth(
     for (let s = 1; s <= samplesPerSegment; s++) {
       const t = t1 + (t2 - t1) * (s / samplesPerSegment);
 
-      // Barry-Goldman interpolation
       const a1x =
         ((t1 - t) / (t1 - t0)) * p0[0] + ((t - t0) / (t1 - t0)) * p1[0];
       const a1y =
@@ -143,6 +141,7 @@ class TrailStore {
 }
 
 export function useTrailHistory(flights: FlightState[]): TrailEntry[] {
-  const [store] = useState(() => new TrailStore());
-  return useMemo(() => store.update(flights), [store, flights]);
+  const storeRef = useRef<TrailStore>(null);
+  if (!storeRef.current) storeRef.current = new TrailStore();
+  return useMemo(() => storeRef.current!.update(flights), [flights]);
 }