feat: Telegram OSINT map layer, Osiris intel ports, and maritime settings

Add Telegram OSINT with hourly incremental t.me scraping, metro geocoding
separate from news centroids, threat-intercept popup UI with inline media,
and HTML markers above alert boxes so pins stay clickable. Expose GFW_API_TOKEN
in onboarding and Settings Maritime; harden GFW/CCTV/geo fetchers. Port Osiris-
derived recon, SCM, entity graph, malware/cyber feeds, sanctions, and submarine
cable layers with tests and documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.yml

@@ -17,6 +17,12 @@ services:
       - OPENSKY_CLIENT_ID=${OPENSKY_CLIENT_ID:-}
       - OPENSKY_CLIENT_SECRET=${OPENSKY_CLIENT_SECRET:-}
       - LTA_ACCOUNT_KEY=${LTA_ACCOUNT_KEY:-}
+      - GFW_API_TOKEN=${GFW_API_TOKEN:-}
+      - GFW_EVENTS_PAGE_SIZE=${GFW_EVENTS_PAGE_SIZE:-500}
+      - GFW_EVENTS_MAX_PAGES=${GFW_EVENTS_MAX_PAGES:-10}
+      - GFW_EVENTS_LOOKBACK_DAYS=${GFW_EVENTS_LOOKBACK_DAYS:-7}
+      - GFW_EVENTS_TIMEOUT_S=${GFW_EVENTS_TIMEOUT_S:-90}
+      - WINDY_API_KEY=${WINDY_API_KEY:-}
       - ADMIN_KEY=${ADMIN_KEY:-}
       - FINNHUB_API_KEY=${FINNHUB_API_KEY:-}
       # Override allowed CORS origins (comma-separated). Auto-detects LAN IPs if empty.
@@ -77,6 +83,9 @@ services:
       - FIMI_ENABLED=${FIMI_ENABLED:-false}
       - NUFORC_ENABLED=${NUFORC_ENABLED:-false}
       - NEWS_ENABLED=${NEWS_ENABLED:-true}
+      - TELEGRAM_OSINT_ENABLED=${TELEGRAM_OSINT_ENABLED:-true}
+      - TELEGRAM_OSINT_CHANNELS=${TELEGRAM_OSINT_CHANNELS:-}
+      - TELEGRAM_OSINT_INTERVAL_MINUTES=${TELEGRAM_OSINT_INTERVAL_MINUTES:-60}
     volumes:
       - backend_data:/app/data
     restart: unless-stopped