fix(places): say where a result came from, and stop asking questions in the form

Six changes to the place picker and the card behind it, all of them about a
panel saying less and meaning more.

The TREK place index has no switch in the admin panel any more. It decides
whether a search leaves the instance at all, which is a property of the
deployment rather than a taste: an operator pins TREK_PLACES_ENABLED=false in
their compose file, and it cannot be turned off from a browser by whoever holds
an admin account that day. The switch never shipped, so nothing to migrate.

The standing "Using OpenStreetMap" notice above the search box is gone. It was
a sentence about configuration in the middle of a form about a place, and it
answered a question nobody asked while leaving the real one open. Each result
now carries a small mark instead: TREK, OpenStreetMap or Google. It sits on the
row rather than above the list, because a list can be two indexes interleaved
and a heading could only name one of them.

The saved-places filters open across the full width of the row. Two of them sit
side by side, only one can be open at a time, and list names were being cut at
about ten characters for no reason.

Three empty states use the mascot the rest of TREK uses. The place details panel
no longer tells the reader to go and ask an administrator for a Google key, the
saved-places list and the road trip rail no longer explain themselves in two
lines of grey text. That needed one new mood, `sad`: `sleepy` reads as falling
asleep, which is a different thing from finding nothing.

The Kind of stop field is out of the place form. It is a road trip concept, and
the road trip view already sets it from the stop's own number, where the choice
is next to what it changes.

server/src/app-config/derive.ts

@@ -140,6 +140,18 @@ export function deriveMaps(raw: RawEnv) {
      * who wants nothing to leave their network points at their own machine.
      */
     trekPlacesUrl: raw.TREK_PLACES_URL || undefined,
+    /**
+     * Whether the index answers at all. On unless an operator says otherwise,
+     * because it is the path we want people on and an upgrade must not quietly
+     * drop back to Nominatim, whose usage policy forbids what TREK was doing
+     * with it.
+     *
+     * Deliberately an environment variable and not an admin switch: it decides
+     * whether searches leave the instance, and a setting that reaches for the
+     * network is one an operator wants pinned in their compose file, not one a
+     * second admin can flip in a browser.
+     */
+    trekPlacesEnabled: raw.TREK_PLACES_ENABLED !== 'false',
     placesApiKey: raw.PLACES_API_KEY || undefined,
     /** Public pk.* token shipped with a managed instance; reaches the browser by design. */
     mapboxToken: raw.MAPBOX_ACCESS_TOKEN || undefined,

server/src/app-config/env.schema.ts

@@ -144,6 +144,7 @@ export const envSchema = z.object({
   TREK_MANAGED: boolStr,
   PLACES_API_BASE: url,
   TREK_PLACES_URL: url,
+  TREK_PLACES_ENABLED: boolStr,
   PLACES_API_KEY: anyString,
   MAPBOX_ACCESS_TOKEN: anyString,
   CARTO_API_KEY: anyString,

server/src/nest/addons/addons.service.ts

@@ -218,28 +218,6 @@ export class AddonsService {
 
   updatePlacesEnrich(enabled: boolean) { return this.writeFlag('places_enrich_enabled', enabled); }
 
-  /**
-   * The TREK place index, read fail-OPEN for the same reason enrichment is.
-   *
-   * This is the one switch on the card that is about egress rather than about
-   * spending: with it on, every search and every keystroke in the place box
-   * leaves the instance for places.liketrek.com. An operator who does not want
-   * that needs somewhere to say so, and until this pair existed the key was
-   * read by six call paths and written by nobody — the only way to turn the
-   * index off was an INSERT against app_settings by hand.
-   *
-   * It has to agree with MapsService.trekPlacesEnabled(), which reads the same
-   * key the same way. If the two ever disagree, the panel shows "off" while the
-   * queries keep leaving, which is the worst of both.
-   */
-  getTrekPlaces() {
-    const row = this.db.prepare("SELECT value FROM app_settings WHERE key = 'trek_places_enabled'").get() as
-      | { value: string }
-      | undefined;
-    return { enabled: row?.value !== 'false' };
-  }
-  updateTrekPlaces(enabled: boolean) { return this.writeFlag('trek_places_enabled', enabled); }
-
   // ── Transit backend (#1699) ────────────────────────────────────────────────
   // Not a flag: two named backends, so it stores the name rather than a
   // boolean. The read/write pair lives in transit/transit-provider.ts because

server/src/nest/admin/admin.controller.ts

@@ -253,20 +253,6 @@ export class AdminController {
     return result;
   }
 
-  // The one switch here that is about egress rather than about spending: with
-  // the index on, every search and every keystroke in the place box leaves the
-  // instance. Six call paths read the key; until this pair existed nothing
-  // wrote it, so an operator who wanted it off had no way to say so.
-  @Get('trek-places')
-  getTrekPlaces() { return this.addons.getTrekPlaces(); }
-
-  @Put('trek-places')
-  updateTrekPlaces(@CurrentUser() user: User, @Body() body: AdminFeatureToggleDto, @Req() req: Request) {
-    const result = this.addons.updateTrekPlaces(body.enabled);
-    this.audit.writeAudit({ userId: user.id, action: 'admin.trek_places', ip: getClientIp(req), details: { enabled: result.enabled } });
-    return result;
-  }
-
   @Get('collab-features')
   getCollabFeatures() { return this.addons.getCollabFeatures(); }
 

server/src/nest/maps/maps.service.ts

@@ -662,16 +662,19 @@ export class MapsService {
   }
 
   /**
-   * Fail-OPEN, unlike the three Google switches: the index is the path we want
-   * people on, and an install that upgrades without visiting the admin panel
-   * should land on it rather than stay on Nominatim, whose usage policy forbids
-   * what TREK was doing with it.
+   * Whether the index answers on this instance.
+   *
+   * On unless TREK_PLACES_ENABLED says otherwise, because the index is the path
+   * we want people on and an upgrade must not quietly drop back to Nominatim,
+   * whose usage policy forbids what TREK was doing with it.
+   *
+   * An environment variable rather than an admin switch on purpose. This decides
+   * whether a search leaves the instance at all, which is a property of the
+   * deployment: an operator pins it in their compose file, and it cannot be
+   * turned off from a browser by whoever holds an admin account that day.
    */
   trekPlacesEnabled(): boolean {
-    const row = this.database.get<{ value: string }>(
-      "SELECT value FROM app_settings WHERE key = 'trek_places_enabled'",
-    );
-    return row?.value !== 'false';
+    return readEnv().maps.trekPlacesEnabled;
   }
 
   /**