Add Geoapify persistent geocoding and offline-capable routing

[stef-k]

Summary

• add protected, independently authorized Geoapify reverse geocoding and routing over the shared personal-provider authority introduced by Protect personal provider credentials and enforce provider-specific usage budgets #499
• add persistent reverse enrichment, explicit bounded backfill, provider-specific stable Transport Profile mappings, and conservative shared-credit routing admission
• persist explicitly accepted Trip route geometry, instructions, provenance, storage authority, and Geoapify/OpenStreetMap attribution
• expose authenticated provider-neutral mobile routing capability/route endpoints without public OSRM fallback or provider credentials on the device
• preserve existing enrichment, accepted geometry, manual/Direct behavior, OSRM-compatible Trip Editor routing, historical data, and older mobile compatibility on unavailable or failed provider paths

Safety and concurrency

• one 2,500-credit rolling 24-hour Geoapify pool is shared by geocoding and routing
• admitted contacts commit before HTTP and remain counted after timeout, failure, malformed response, or cancellation
• same-user backfill invocations serialize durably through PostgreSQL while different users remain independent
• mobile routing requires current personally selected Geoapify authority and cannot fall back to server-default OSRM
• route parsing rejects incoherent anchors, legs, steps, geometry, distance, or duration before proposal/persistence
• administrator mappings use stable provider-configuration and Transport Profile identities, never display-name matching

Database migration

Adds the additive migration:

• 20260823175624_AddGeoapifyRouteProvenance

It adds nullable bounded Segment instruction/provenance/attribution/storage-authority fields. Existing Locations, Trips, Places, Segments, geometry, enrichment, credentials, and provider usage are not deleted or rewritten.

Validation

Fresh implementation/correction evidence includes:

• complete ordinary .NET suite before final bounded corrections: 2,611 passed, 0 failed/skipped
• final focused Geoapify/provider/routing/Trip/mobile correction selections: passed
• guarded PostgreSQL verification, rolling-credit, same-user serialization, cancellation, admission-durability, and concurrency tests: passed
• final GeoapifyBackfillConcurrencyPostgresTests: 4 passed, 0 failed/skipped
• client suite: 93 passed
• focused mapping browser rendering: passed after provisioning the pinned Playwright browser
• frontend typecheck and production build: passed
• Release build: passed with zero warnings/errors
• EF pending-model check: no pending changes
• LOC policy: passed; one cohesive shared DTO file reached the 400-line review threshold, with no 600-line failure
• git diff --check: passed
• no public Geoapify, Mapbox, OSRM, or other provider request was made

The complete suite was not rerun after the final tests-only assertion strengthening; exact-head GitHub Actions test is the merge gate.

Follow-up

#507 adds the Quartz-backed, restart-safe Start/Pause/Resume/Cancel workflow needed to enrich very large location-history imports without repeated manual 100-record actions. It consumes this PR after merge and is included in release coordination issue #505.

Closes #502
Related to #505
Follow-up #507