fix: miscellaneous bug fixes (#1139)

* fix(share): serve place thumbnails in shared trip links (#1100)

Google-sourced place photos are stored as image_url pointing at the
JWT-guarded /api/maps/place-photo/:placeId/bytes endpoint, so they 401
for an unauthenticated shared-trip viewer and render as broken images.

Rewrite place image_url values in the shared payload to a public,
token-scoped proxy (/api/shared/:token/place-photo/:placeId/bytes) and
add an unguarded SharedController route that validates the token and that
the place belongs to its trip before streaming the cached bytes. Mirrors
the existing JourneyPublicController precedent. No client changes needed.

* fix(atlas): replace Natural Earth with geoBoundaries for up-to-date regions (#1119)

Atlas sourced country and sub-national boundaries from Natural Earth's GitHub
`master` at runtime. That data is stale (e.g. it still shows Norway's pre-2020
counties such as Oppland/Hordaland) and depicts some contested territory in
unwanted ways (nvkelso/natural-earth-vector#391), so Natural Earth is dropped
entirely.

- Country borders (admin0) now come from the geoBoundaries CGAZ composite;
  sub-national regions (admin1) from per-country gbOpen, which carries ISO 3166-2
  codes. A new script (server/scripts/build-atlas-geo.mjs) normalizes and quantizes
  them into committed gzipped bundles under server/assets/atlas, read server-side at
  runtime (no network at boot, no GitHub CSP allowlist entry).
- New GET /addons/atlas/countries/geo serves the country layer; the client fetches
  it from the API instead of GitHub.
- A migration reconciles manually-marked visited_regions against the new bundle
  (valid code -> keep; region name still matches -> re-code; curated merge crosswalk
  for renamed reforms; else leave intact), with UNIQUE-safe dedup. bucket_list and
  visited_countries hold only invariant alpha-2 country codes, so they are untouched.
- Attribution added (NOTICE.md + README) per geoBoundaries CC BY 4.0.

Closes #1119

* fix(packing): make templates admin-only to create, usable by members

Creating a packing-list template was gated only by trip access, so any
trip member could create one from the Lists feature, while applying a
template silently failed for non-admins because the apply dropdown was
populated from the AdminGuard-protected /api/admin/packing-templates
endpoint.

- save-as-template now returns 403 for non-admins; the Save-as-Template
  button is hidden unless the user is an admin (both the TripPlanner
  toolbar and the inline packing header).
- add member-accessible GET /api/trips/:tripId/packing/templates so the
  apply dropdown lists templates for any trip member; client fetches
  from it instead of the admin endpoint.

Closes #1120
Closes #1121

* fix(packing): show bag tracking to non-admin members

The global Bag Tracking toggle was only readable via the admin-gated
GET /api/admin/bag-tracking, so non-admin trip members got 403 and the
weight fields, bag circles, and BAGS sidebar never rendered (#1124).

Surface the flag through the already-authenticated GET /api/addons
(loaded into the client addon store on app start for every user); the
packing hook reads it from the store instead of the admin endpoint. The
admin write path stays admin-gated and unchanged.

server/tests/unit/services/atlasService.test.ts

@@ -31,7 +31,7 @@ import { createTables } from '../../../src/db/schema';
 import { runMigrations } from '../../../src/db/migrations';
 import { resetTestDb } from '../../helpers/test-db';
 import { createUser, createTrip } from '../../helpers/factories';
-import { getStats, getCached, setCache, getCountryFromCoords, getCountryFromAddress, reverseGeocodeCountry, getRegionGeo, getCountryPlaces, getVisitedRegions } from '../../../src/services/atlasService';
+import { getStats, getCached, setCache, getCountryFromCoords, getCountryFromAddress, reverseGeocodeCountry, getRegionGeo, getCountryGeo, getCountryPlaces, getVisitedRegions } from '../../../src/services/atlasService';
 
 function insertPlace(db: any, tripId: number, name: string, address: string | null = null) {
   const cat = db.prepare('SELECT id FROM categories LIMIT 1').get() as { id: number } | undefined;
@@ -243,38 +243,57 @@ describe('reverseGeocodeCountry', () => {
 
 // ── getRegionGeo ────────────────────────────────────────────────────────────
 
+// These read the committed geoBoundaries bundle (server/assets/atlas/admin1.geojson.gz),
+// so they double as a guard that the bundle ships current sub-national data (#1119).
 describe('getRegionGeo', () => {
-  it('ATLAS-SVC-017: returns empty FeatureCollection when fetch throws a network error', async () => {
-    // Override the default stub to throw so loadAdmin1Geo's .catch handler runs,
-    // returning null — which causes getRegionGeo to return the empty FeatureCollection.
-    // (The default ok:false stub does NOT trigger the catch; it still resolves json()
-    // to {}, which loadAdmin1Geo caches as a non-null truthy value.)
-    vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('Network failure')));
-    const result = await getRegionGeo(['DE', 'FR']);
+  it('ATLAS-SVC-017: returns an empty FeatureCollection for a country with no admin-1 features', async () => {
+    const result = await getRegionGeo(['ZZ']);
     expect(result).toEqual({ type: 'FeatureCollection', features: [] });
   });
 
-  it('ATLAS-SVC-018: returns filtered features for matching country codes when fetch returns mock GeoJSON', async () => {
-    // ATLAS-SVC-017 ran with a throwing fetch, so admin1GeoCache is null and
-    // admin1GeoLoading is null — this test's fetch override will be called.
-    const mockGeoJson = {
-      type: 'FeatureCollection',
-      features: [
-        { type: 'Feature', properties: { iso_a2: 'DE' }, geometry: {} },
-        { type: 'Feature', properties: { iso_a2: 'FR' }, geometry: {} },
-      ],
-    };
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
-      ok: true,
-      json: async () => mockGeoJson,
-    }));
-
-    // Pass lowercase 'de' — getRegionGeo uppercases internally for matching
-    const result = await getRegionGeo(['de']);
+  it('ATLAS-SVC-018: returns the current geoBoundaries regions for a country, case-insensitively', async () => {
+    // Pass lowercase 'no' — getRegionGeo uppercases internally for matching.
+    const result = await getRegionGeo(['no']);
 
     expect(result.type).toBe('FeatureCollection');
-    expect(result.features).toHaveLength(1);
-    expect(result.features[0].properties.iso_a2).toBe('DE');
+    expect(result.features.length).toBeGreaterThan(0);
+    expect(result.features.every((f: any) => f.properties.iso_a2 === 'NO')).toBe(true);
+
+    const names = result.features.map((f: any) => f.properties.name);
+    const codes = result.features.map((f: any) => f.properties.iso_3166_2);
+    // Post-2020 reform is present…
+    expect(codes).toContain('NO-34'); // Innlandet
+    expect(codes).toContain('NO-46'); // Vestland
+    // …and the merged-away pre-2020 counties are gone (the original #1119 bug).
+    expect(names).not.toContain('Oppland');
+    expect(names).not.toContain('Hordaland');
+    expect(names).not.toContain('Sogn og Fjordane');
+  });
+});
+
+describe('getCountryGeo', () => {
+  it('ATLAS-SVC-019: returns the admin-0 FeatureCollection with ISO_A2/ADM0_A3 properties', () => {
+    const geo = getCountryGeo();
+    expect(geo.type).toBe('FeatureCollection');
+    expect(geo.features.length).toBeGreaterThan(0);
+    const no = geo.features.find((f: any) => f.properties.ISO_A2 === 'NO');
+    expect(no).toBeDefined();
+    expect(no.properties.ADM0_A3).toBe('NOR');
+    expect(no.properties.NAME).toBe('Norway');
+  });
+
+  it('ATLAS-SVC-020: includes territories that the curated list dropped (Greenland + Svalbard)', () => {
+    const geo = getCountryGeo();
+    // Greenland is its own feature.
+    expect(geo.features.some((f: any) => f.properties.ISO_A2 === 'GL')).toBe(true);
+    // Svalbard has no separate ISO entity in geoBoundaries; it sits inside Norway's
+    // geometry (lat ~74-81°N). Guard that the country polygon reaches those latitudes.
+    const no = geo.features.find((f: any) => f.properties.ISO_A2 === 'NO');
+    const maxLat = (function max(coords: any): number {
+      if (typeof coords[0] === 'number') return coords[1];
+      return Math.max(...coords.map(max));
+    })(no.geometry.coordinates);
+    expect(maxLat).toBeGreaterThan(78);
   });
 });