Add polygon notes (Area mode) to the user overlay tool

notes.js: Point/Area mode toggle mirroring measure.js's UX — Area
mode accumulates clicked vertices with a live dashed-preview polygon
(own small preview source/layers), a Finish button once 3+ corners
are placed, then the same save form as Point mode.

gpx.js's _addLayers now also renders Polygon features from a file's
"lines" source (fill + outline, filtered by geometry-type — the
existing line layer already only draws LineString, so this is just
two more layers on the same source, not a new bucket) with
popup-on-click like a waypoint, not the track line's hover-summary/
profile-panel behavior. Without this a saved polygon wouldn't have
rendered back on reload.

Fixed along the way: .notes-panel__form/.notes-panel__modes both set
their own `display`, which silently wins over the browser's default
`[hidden] { display: none }` (author styles always beat user-agent
ones) — same gotcha .gpx-panel__action[hidden] already has a comment
about. The form was never actually invisible before being opened.

Verified live: real polygon file (fill/outline render, click ->
popup) and the full Area-mode draw flow (mode switch, live preview,
Finish, form) via headless Chrome. Full test suite: 104 runs, 0
failures — one new backend test confirms a Polygon feature round-
trips through POST /api/gpx/notes.

Known gap (noted in TODO.adoc): the category filter matrix only
re-slices the points source, so toggling "Note" off hides point notes
but not polygon ones.

test/test_app.rb

@@ -176,7 +176,20 @@ class AppTest < Minitest::Test
     assert_equal 400, response.status
   end
 
-  # --- Notes (hand-drawn points, notes.js) ---
+  # --- Notes (hand-drawn points/areas, notes.js) ---
+
+  def test_notes_accepts_a_polygon_feature
+    polygon = JSON.generate(
+      "type" => "Feature",
+      "properties" => { "name" => "Turning area", "category" => "Note" },
+      "geometry" => { "type" => "Polygon", "coordinates" => [[[17.1, 48.1], [17.2, 48.1], [17.2, 48.2], [17.1, 48.1]]] },
+    )
+    response = request.post("/api/gpx/notes", params: { feature: polygon, name: "Areas" }, **logged_in_env)
+
+    assert_equal 200, response.status
+    geometry = json_body(request.get("/api/gpx/file/Areas.geojson"))["features"][0]["geometry"]
+    assert_equal "Polygon", geometry["type"]
+  end
 
   def test_notes_requires_login
     assert_equal 401, request.post("/api/gpx/notes", params: { feature: sample_note_feature, name: "Notes" }).status