Fix note UX: unreachable wiki link, white Save hover, stale icon preview, invisible new points

- "Nearby on Wikipedia" linked to KIWIX_URL, a Docker-internal hostname
  (http://kiwix:8080) no real browser can resolve. Split it: KIWIX_URL
  stays server-side-only for the reachability check, and the link
  itself is built from KIWIX_PUBLIC_PORT (kiwix-serve's newly
  published host port) plus whatever host the visitor already used to
  reach maptool — works regardless of which hostname/IP that is.
- The Save button went white on hover in GTK-themed Chrome: the
  browser's native button skin was painting over the custom
  background because appearance wasn't reset.
- The map preview marker for a pending note always showed a plain red
  pin no matter which icon was picked in the form. NoteSaveForm now
  reports icon changes via onIconChange so NotesControl can update the
  marker's glyph live.
- Saving a note (or a Measure "Save as note") left the new/grown
  .geojson file unchecked and invisible until manually toggled on.
  notifyGpxStoreChanged now carries the affected path so
  GpxPanelControl auto-shows it.

app.rb

@@ -73,9 +73,21 @@ module Maptool
     # An external kiwix-serve instance (see docs/development.adoc), not
     # something this app runs itself — blank disables the "Nearby on
     # Wikipedia" popup link the same way the other optional-integration
-    # blanks above do.
+    # blanks above do. This is reached server-side only (the reachability
+    # check below, same-Docker-network service name in production, e.g.
+    # "http://kiwix:8080") — it is NOT what gets handed to the browser, see
+    # KIWIX_PUBLIC_PORT.
     KIWIX_URL = ENV.fetch("KIWIX_URL", "")
 
+    # The port kiwix-serve is published on for browsers to reach directly
+    # (docker-compose.yaml's kiwix service ports: mapping) — KIWIX_URL above
+    # is a Docker-network-internal hostname a real browser can't resolve at
+    # all, so the "Nearby on Wikipedia" link is instead built from whatever
+    # host the visitor already used to reach maptool itself
+    # (request.host) plus this port. Blank disables the link, same as a
+    # blank KIWIX_URL.
+    KIWIX_PUBLIC_PORT = ENV.fetch("KIWIX_PUBLIC_PORT", "")
+
     # Login delegates to the Gitea instance the user already has an account
     # on, rather than maintaining a local username/password — see
     # docs/architecture.adoc. Only users listed in ALLOWED_GITEA_USERS may
@@ -208,9 +220,14 @@ module Maptool
 
     # Pinged once per page load (public/js/map.js) — url is handed back so
     # the frontend can build the geo-search link itself; this server never
-    # proxies to kiwix-serve, just says whether it's there.
+    # proxies to kiwix-serve, just says whether it's there. url is built
+    # from request.host (whatever hostname/IP the visitor already used to
+    # reach maptool itself) + KIWIX_PUBLIC_PORT, not KIWIX_URL — that's a
+    # Docker-network-internal address only this server can resolve.
     get "/api/kiwix" do
-      json available: Kiwix.reachable?(KIWIX_URL), url: KIWIX_URL
+      reachable = Kiwix.reachable?(KIWIX_URL)
+      url = KIWIX_PUBLIC_PORT.empty? ? "" : "http://#{request.host}:#{KIWIX_PUBLIC_PORT}"
+      json available: reachable && !url.empty?, url: url
     end
 
     get "/api/gpx/tree" do