Go global: worldwide BTC Map sync, marker clustering, response compression

- Sync now pulls every BTC Map place worldwide (~29k live), not just
  Madeira — dropped BTCMAP_CENTER_LAT/LON/RADIUS_KM entirely.
- Incremental via a stored watermark (settings.btcmap_synced_since):
  only fetches what changed since the last sync, not the whole dataset
  every time. Handles deletions too (BTC Map delistings correctly evict
  the local place + cascade its claim/links, not just go unclaimed).
- Real bug caught and fixed before it shipped: tried BTC Map's own
  recommended updated_since+limit pagination first, but their timestamps
  mix millisecond and whole-second precision, and naive string comparison
  across that isn't chronologically safe — silently truncated a real
  sync to ~4,000 of ~42,000 records with no error. Measured the
  alternative (single unpaginated request) instead: 2-3s for the full
  dataset, simpler and actually correct. Full writeup in
  services/btcmap.ts, regression test for the specific bug in
  services/btcmap.test.ts.
- @fastify/compress added — the places list is now tens of thousands of
  rows, gzip/br/zstd auto-negotiated.
- Also fixed while touching dependencies: @fastify/static had a real
  high-severity path-traversal/auth-bypass advisory (GHSA-pr96-94w5-mx2h
  et al) affecting the version we were pinned to — bumped to the patched
  10.1.2.
- Frontend: leaflet.markercluster (raw per-marker rendering doesn't scale
  to tens of thousands of points), cyberpunk-themed cluster icons to
  match the existing HUD styling, batch marker insertion (addLayers, not
  a per-marker addLayer loop) since that's dramatically faster at this
  scale. Default map view is now world-scale, recentering on the
  player's location if geolocation is available.
- 60 backend tests passing throughout (7 new for the sync rewrite).

server/src/config.ts

@@ -15,10 +15,11 @@ const envSchema = z.object({
   ROUTE_PREFIX: z.string().default(''),
   NIP98_MAX_SKEW_SECS: z.coerce.number().default(60),
   SESSION_TTL_DAYS: z.coerce.number().default(30),
-  // Default sync area: Madeira, Portugal (Funchal-centered radius covering the whole island).
-  BTCMAP_CENTER_LAT: z.coerce.number().default(32.7607),
-  BTCMAP_CENTER_LON: z.coerce.number().default(-16.9595),
-  BTCMAP_RADIUS_KM: z.coerce.number().default(45),
+  // Base URL for BTC Map's API — global sync pulls every place worldwide via
+  // the chronological /v4/places endpoint (paginated, incremental via a
+  // stored watermark — see routes/sync.ts), not scoped to any region.
+  // Overridable for tests to point at a mock server instead of the real API.
+  BTCMAP_API_BASE_URL: z.string().url().default('https://api.btcmap.org'),
   // How close (in meters) a player must be to a place to claim it or link from it.
   CLAIM_RADIUS_METERS: z.coerce.number().default(40),
   // Maximum link length, in kilometers — mirrors Ingress's level-scaled link