fix(ui): SAR credential setup in Settings and async layer toggles.

Add Earthdata token entry on the SAR tab with accurate Mode B status, expose optional FIRMS_MAP_KEY in API settings, and remove the frontend operator-unlock gate that blocked localhost saves. Run network-heavy layer-enable fetches on a background executor with frontend retry polling so FIRMS toggles no longer freeze the single API worker.

backend/services/api_settings.py

@@ -78,6 +78,15 @@ API_REGISTRY = [
         "url": "https://earthquake.usgs.gov/",
         "required": False,
     },
+    {
+        "id": "firms_map_key",
+        "env_key": "FIRMS_MAP_KEY",
+        "name": "NASA FIRMS — MAP Key (optional)",
+        "description": "Optional NASA Earthdata MAP key for country-scoped VIIRS fire enrichment. Global VIIRS hotspots work without a key; set this only if you want per-country FIRMS detail. Free from NASA Earthdata.",
+        "category": "Geophysical",
+        "url": "https://firms.modaps.eosdis.nasa.gov/api/area/",
+        "required": False,
+    },
     {
         "id": "celestrak",
         "env_key": None,