Split offline hiking trails per country, add a picker instead of one big file

data/hiking_trails.geojson is now data/hiking_trails/<CODE>.geojson —
one file per country instead of a merge, generated per-source
(PmtilesBuilder.extract_hiking_trails), cached the same way
geofabrik_cache is (skipped once a country's own extract is already
newer than its source .osm.pbf, so growing the selection by one
country only re-extracts that one). GET /api/hiking-trails now lists
available country codes instead of a single file's status.

The Overlays panel's "Hiking trails" item becomes an expandable
per-country checklist once any offline extract exists (same shape as
Radar's own expand), replacing the plain on/off checkbox — nobody
covering a dozen countries' worth of offline map data needs all of
their hiking trails loaded and parsed at once, so each ticked country
fetches its own GeoJSON independently instead.

HikingTrails.extract_merged (server-side multi-country merge, no
longer needed now that the client picks per country) removed again.
Verified the new extract_hiking_trails + caching skip live on brick
against a real cached country PBF.

test/test_app.rb

@@ -39,13 +39,17 @@ class AppTest < Minitest::Test
     assert_equal({ "available" => false }, json_body(response))
   end
 
-  def test_hiking_trails_reports_unavailable_when_no_geojson_present
+  def test_hiking_trails_reports_no_countries_when_none_extracted_yet
     response = request.get("/api/hiking-trails")
-    assert_equal({ "available" => false }, json_body(response))
+    assert_equal({ "countries" => [] }, json_body(response))
   end
 
-  def test_hiking_trails_file_404s_when_no_geojson_present
-    assert_equal 404, request.get("/tiles/hiking_trails.geojson").status
+  def test_hiking_trails_file_404s_for_a_country_with_no_extract
+    assert_equal 404, request.get("/tiles/hiking_trails/SK.geojson").status
+  end
+
+  def test_hiking_trails_file_404s_for_a_malformed_country_code
+    assert_equal 404, request.get("/tiles/hiking_trails/../../etc/passwd.geojson").status
   end
 
   def test_kiwix_reports_unavailable_when_no_url_configured