feat: Telegram OSINT map layer, Osiris intel ports, and maritime settings

Add Telegram OSINT with hourly incremental t.me scraping, metro geocoding
separate from news centroids, threat-intercept popup UI with inline media,
and HTML markers above alert boxes so pins stay clickable. Expose GFW_API_TOKEN
in onboarding and Settings Maritime; harden GFW/CCTV/geo fetchers. Port Osiris-
derived recon, SCM, entity graph, malware/cyber feeds, sanctions, and submarine
cable layers with tests and documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/third_party/osiris/NOTICE.md

@@ -0,0 +1,14 @@
+# Osiris-derived components — third-party notice
+
+Portions of the recon toolkit, sanctions index, SCM overlay, entity graph,
+malware feeds, and related UI were adapted from:
+
+- **OSIRIS** — MIT License — Copyright (c) 2026 simplifaisoul  
+  https://github.com/simplifaisoul/osiris
+
+Additional data attribution:
+
+- **OpenSanctions** `us_ofac_sdn` dataset — CC-BY 4.0  
+  https://www.opensanctions.org/
+- **TeleGeography** submarine cable map data (static GeoJSON)
+- **abuse.ch** Feodo Tracker / URLhaus (malware feeds)