poi-index: extract pipeline (BRouter host) + import job (flagship) + e2e

- poi-extract.sh: PBF download -> osmium tags-filter -> centroid NDJSON +
  manifest, published via the Caddy sidecar at vSwitch-only /poi/*
- osmium-filters.txt + poi-selectors.sql generated from map-core selectors,
  guarded by sync tests so poiCategories stays the single source of truth
- poi-import.sh: checksum verify -> classify into category rows ->
  70% guard (--bootstrap override) -> atomic rename swap; node_exporter
  textfile metric for import outcome
- systemd service+timer units for both halves (monthly, offset)
- cd-infra.yml: ship infrastructure/scripts to the flagship
- e2e: mock /api/pois instead of /api/overpass

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infrastructure/brouter-host/docker-compose.yml

@@ -58,6 +58,9 @@ services:
       BROUTER_AUTH_TOKEN: ${BROUTER_AUTH_TOKEN:?BROUTER_AUTH_TOKEN must be set}
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      # POI index artifact published by poi-extract.sh, served read-only under
+      # /poi/* on the same vSwitch-only listener as BRouter.
+      - ./poi-extract/publish:/srv/poi:ro
       - caddy-data:/data
       - caddy-config:/config
     networks: