[fix](trx-frontend-http): correct map auth and overlay behavior

Treat the SPA entry routes as public so direct requests to /map,\n/decoders, /settings, and /about return the app shell and let\nthe frontend show the login screen instead of a 403.\n\nMove the map filter overlay to the bottom-right corner and color\ndecode contact paths by their decoded band so they match the band\nlegend and locator overlays.\n\nVerified with cargo test -p trx-frontend-http.\n\nCo-authored-by: OpenAI Codex <codex@openai.com>

Signed-off-by: Stan Grams <sjg@haxx.space>

src/trx-client/trx-frontend/trx-frontend-http/assets/web/app.js

@@ -4124,8 +4124,13 @@ function midpointLatLon(a, b) {
 }
 
 function decodeContactPathColor(entry) {
+  if (entry?.bandLabel) return locatorBandChipColor(entry.bandLabel);
   const srcEntry = locatorMarkers.get(entry?.sourceGrid);
-  if (srcEntry) return locatorStyleForEntry(srcEntry, locatorEntryCount(srcEntry)).color;
+  if (srcEntry) {
+    const label = locatorBandLabelForEntry(srcEntry);
+    if (label) return locatorBandChipColor(label);
+    return locatorStyleForEntry(srcEntry, locatorEntryCount(srcEntry)).color;
+  }
   return locatorFilterColor("ft8");
 }
 
@@ -5723,11 +5728,13 @@ function rebuildDecodeContactPaths() {
         }
       }
       if (source && target && source !== target) {
+        const band = bandForHz(Number(detail?.freq_hz));
         directedMessages.push({
           source,
           target,
           sourceGrid: grid,
           tsMs,
+          bandLabel: band?.label || null,
         });
       }
     }
@@ -5747,6 +5754,7 @@ function rebuildDecodeContactPaths() {
       target: msg.target,
       sourceGrid: msg.sourceGrid,
       targetGrid: targetLocator.grid,
+      bandLabel: msg.bandLabel,
       from: sourceCenter,
       to: targetCenter,
       tsMs: msg.tsMs,