fix(mobile,map): long toasts wrap and http selfhosts get the right geolocation message (#2095)

The phone toast was a single truncated pill, which cut the denied message exactly before the settings hint it exists for; long messages wrap up to four lines now. An insecure context is reported as its own error instead of masquerading as a blocked device permission.

client/src/hooks/useGeolocation.ts

@@ -20,7 +20,7 @@ export type TrackingMode = 'off' | 'show' | 'follow'
 // Typed counterpart to the raw error string. The string is whatever the
 // browser produced (raw WebKit English on iOS), so the UI keys off this
 // code to show a localized, actionable message instead.
-export type GeoWatchErrorCode = 'permission-denied' | 'unavailable' | 'timeout' | 'unsupported'
+export type GeoWatchErrorCode = 'permission-denied' | 'unavailable' | 'timeout' | 'unsupported' | 'insecure-context'
 
 export interface UseGeolocationReturn {
   position: GeoPosition | null
@@ -139,6 +139,14 @@ export function useGeolocation(): UseGeolocationReturn {
       setErrorCode('unsupported')
       return false
     }
+    // Same block getCurrentPositionOnce guards against: on a plain-HTTP origin
+    // the browser answers PERMISSION_DENIED, which would otherwise read as a
+    // revoked device permission and send the user into their OS settings.
+    if (window.isSecureContext === false) {
+      setError('Location requires a secure (HTTPS) connection')
+      setErrorCode('insecure-context')
+      return false
+    }
     // Already watching, or still waiting on the iOS prompt below: a second
     // subscription would overwrite watchIdRef and leave the first one running
     // with nobody left holding its id.