Add welcome modal, fix mobile layout, custom zoom FABs

[cafca]

Summary

• Welcome modal: shown to first-time visitors (new anonymous session = no existing session cookie). Contains a short app description, three usage steps, a sign-up nudge, and a greyed-out privacy notice. Dismissed with a single "Start exploring" button.
• Mobile layout fix: search bar and user bar were independently absolutely-positioned and collided for long usernames / multiple auth buttons. Wrapped in a shared flex container that collapses to a single merged card on mobile (no gap, shared shadow).
• Custom zoom FABs: replaced MapLibre's built-in NavigationControl with two circular FABs (ZoomControls.svelte) that match the undo/redo FAB style (48 px on mobile, 40 px on desktop, bottom-right).
• SVG icons: undo, redo, zoom in, and zoom out buttons now use SVGs instead of Unicode characters for reliable centering.

Reviewer notes

• First-visit detection is purely frontend: auth.isNewSession is set to true in checkSession() when api.me() fails and a new anonymous session is created. No backend or localStorage changes.
• The welcome modal content was edited by the user directly (intro copy, step 2 wording, sign-up prompt, privacy paragraph).
• The spec doc lives at docs/superpowers/specs/2026-04-15-welcome-modal-design.md.