v0.2.1

v0.2.1 hardens the local server and the MCP panel, shrinks the build, and refines the Cyber HUD. It also catches up on everything new since v0.1.1 that the first v0.2.0 notes left out.

## Security

- **Cross-site requests refused** for the endpoints that cost money or write logs (OpenAI realtime and HUD summary, Google Places, the voice debug log), and the dev and preview servers send one full Content-Security-Policy.
- **Cost-bearing proxies throttled by default**: 30 requests a minute for OpenAI and 120 for Google per client, the caps Pinokio already ships. `0` opts out, and an unreadable value falls back to the default instead of unlimited.
- **Host checks everywhere**: the Host check now runs before the app's own routes (they used to answer any Host, including DNS-rebinding names), and binding to all interfaces keeps the check, accepting IP addresses, `localhost` and the LAN names you list.
- **The MCP server and panel**: the panel's requests need a key from its own page and refuse settings, credential and model routes in any spelling; panels share six requests in flight; `/mcp` applies the same proxy and origin checks as Provider Settings and times out request bodies; embed mode can no longer be framed unless you allow the framing page. [SECURITY.md](https://github.com/bilawalsidhu/gods-eye-view/blob/main/SECURITY.md) describes the MCP surface.
- The voice debug log keeps the server's own timestamps, and responses send `nosniff`.

**Behavior change:** hostnames ending in `.local` are no longer accepted by default; add them to `GEV_ALLOWED_HOSTS`. A God's Eye View panel opened before updating needs a reload.

## Other changes

- **A smaller build**: each bundled data pack ships once, taking `dist/` from 54 MB to 42 MB.
- **Cyber HUD**: rails no longer crowd the coordinates and attribution, Voice and pin interactions are no longer clipped, and the visual preset you picked is restored when you leave Cyber.

## Also new since v0.1.1

The first v0.2.0 notes missed much of what shipped; they are now [complete](https://github.com/bilawalsidhu/gods-eye-view/releases/tag/v0.2.0). The highlights:

- **Recent Imagery**: the last 30 days of keyless NASA imagery for any box or view, compared **A/B** between two days or against the basemap, with the best day **draped automatically** on the globe.
- **Draw and Directions**: draw areas, lines and pins on the world, and get keyless drive, walk or bike routes with turn-by-turn steps you can **fly** step by step. Tilt Map and North Up keep a tracked target centred.
- **Thousands more cameras**: about 3,400 CCTV cameras by default across Ontario, Finland, British Columbia, Texas, Estonia, Warendorf, Sydney/NSW and Calgary, with **live video** for Delaware's statewide cameras, and a **Mapped ALPR Cameras** layer for the US and Canada.
- **Transit and local receivers**: live buses, trains and ferries in seven regions, and a USB RTL-SDR for FM and ADS-B right in the browser.
- **Weather and fires**: radar, infrared clouds, lightning, cyclone tracks, global wind, and Fire Perimeters.
- **Your agent**: God's Eye View in Claude, Codex and ChatGPT ([setup](https://github.com/bilawalsidhu/gods-eye-view/blob/main/docs/MCP_SETUP.md)).

## Community

Thank you to the people behind this release's fixes:

- @jasas1 — blocked cross-site requests to the cost-bearing and log endpoints and shipped the Content-Security-Policy (#900, from #242)
- @daikaginza — default throttles on the cost-bearing proxies (#900, from #683)
- @puspoaditya — kept the Host check when binding to all interfaces (#900, from #97)
- @Sunil56224972 — found the overwritable debug-log timestamps and the missing nosniff header (#900, from #710)
- @manjunath22466 — the Cyber HUD layout and preset restoration fixes (#873)

Everyone who contributed to v0.2.0 is credited, with what they built, in the [v0.2.0 notes](https://github.com/bilawalsidhu/gods-eye-view/releases/tag/v0.2.0).

## Verification

- Node 24.14, Node 26.x and Windows onboarding CI passed.
- Unit suite: 5,601 passed, 0 failed, 1 intentional skip.
- Production build passed.
- Tracking regression: 109 passed, 0 failed.

Existing Pinokio installs can choose **Update**; terminal installs can run `git pull`.

[Compare v0.2.0...v0.2.1](https://github.com/bilawalsidhu/gods-eye-view/compare/v0.2.0...v0.2.1)