poi-index: map-core selectors, planner.pois schema, /api/pois route + client, metrics

Replace the planner's Overpass proxy with a self-hosted POI index:
- map-core POI categories become structured tag selectors (single source of
  truth) + osmium filter / classification helpers
- planner.pois PostGIS table (centroid points, GiST + category indexes)
- /api/pois serving route (session + same-origin + rate limit, 100 cap)
- lib/pois.ts client (renamed from overpass.ts; GET, quantized bbox)
- metrics: poi_api_requests_total + DB-collected index rows/age gauges;
  drop overpass_* metrics
- remove /api/overpass proxy + dead OVERPASS_URLS on the planner service
  (Journal surface backfill still uses it via code default)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infrastructure/docker-compose.yml

@@ -103,12 +103,6 @@ services:
       # BRouter request. The Caddy sidecar on the dedicated host
       # enforces this header. Set in SOPS secrets.app.env.
       BROUTER_AUTH_TOKEN: ${BROUTER_AUTH_TOKEN:?BROUTER_AUTH_TOKEN must be set in SOPS secrets.app.env}
-      # Ordered failover list for the Overpass proxy. The code defaults
-      # to the same pair if unset; declaring it here makes the prod
-      # upstream explicit and easy to reshuffle via env when a
-      # community instance misbehaves. Override per-env with
-      # OVERPASS_URLS in the SOPS file.
-      OVERPASS_URLS: ${OVERPASS_URLS:-https://lz4.overpass-api.de/api/interpreter,https://overpass-api.de/api/interpreter}
       DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in SOPS secrets.app.env}@postgres:5432/trails
       NODE_ENV: production
       PORT: 3001