[fix](trx-frontend-http): correct map auth and overlay behavior

Treat the SPA entry routes as public so direct requests to /map,\n/decoders, /settings, and /about return the app shell and let\nthe frontend show the login screen instead of a 403.\n\nMove the map filter overlay to the bottom-right corner and color\ndecode contact paths by their decoded band so they match the band\nlegend and locator overlays.\n\nVerified with cargo test -p trx-frontend-http.\n\nCo-authored-by: OpenAI Codex <codex@openai.com>

Signed-off-by: Stan Grams <sjg@haxx.space>

src/trx-client/trx-frontend/trx-frontend-http/assets/web/style.css

@@ -1238,8 +1238,8 @@ small { color: var(--text-muted); }
 }
 .map-overlay-panel {
   position: absolute;
-  top: 0.7rem;
-  left: 0.7rem;
+  right: 0.7rem;
+  bottom: 0.7rem;
   z-index: 410;
   display: flex;
   flex-direction: column;
@@ -1259,7 +1259,7 @@ small { color: var(--text-muted); }
 .map-overlay-panel.is-hidden {
   opacity: 0;
   visibility: hidden;
-  transform: translateY(-0.25rem);
+  transform: translateY(0.25rem);
   pointer-events: none;
 }
 .map-corner-controls {