Add a "user overlay" tool: click the map, save a note

New map-corner "Add note" control (public/js/notes.js), mirroring
measure.js's click-to-place UX. Click the map, write a short note,
pick an existing .geojson layer file or name a new one — saved via a
new GpxStore#append_feature (grows the target file in place, unlike
save()'s always-disambiguate-the-filename behavior) through a new
POST /api/gpx/notes route.

No new rendering path: a note is just another point in a .geojson
file the Tracks panel's tree already lists, checkboxes, and pops up —
visibility toggling ("layers") comes for free from that existing
machinery, per-file, with no changes needed there.

Points only for now — a polygon mode would need gpx.js's point/line
split taught a third Polygon bucket first, or a saved polygon
wouldn't render back on reload (see TODO.adoc).

Covered by new tests: GpxStore#append_feature (create/append/missing-
path/filename-safety) and the /api/gpx/notes route (auth gate, create,
append, malformed/missing-geometry rejection, 404 on a missing
target). Full suite: 97 runs, 0 failures.

public/js/panels.js

@@ -15,3 +15,16 @@ export function onlyOneSidePanelOpen(panel, onClosedByOther) {
     }
   });
 }
+
+// Lets a control that writes into the GPX store (e.g. notes.js saving a
+// drawn point) tell GpxPanelControl its tree is stale, without either one
+// holding a reference to the other.
+const STORE_CHANGED_EVENT = "gpx-store-changed";
+
+export function notifyGpxStoreChanged() {
+  document.dispatchEvent(new CustomEvent(STORE_CHANGED_EVENT));
+}
+
+export function onGpxStoreChanged(callback) {
+  document.addEventListener(STORE_CHANGED_EVENT, callback);
+}