## Summary
Fixes visual lag where high-activity hotspot overlays drift from their
geographic positions during map panning operations.

## Problem
HTML overlays for high-activity hotspots (`level=high` or
`hasBreaking=true`) were only updating positions on a throttled 100ms
delay. During map drag operations, this caused overlays to maintain
their screen position while the map moved underneath, resulting in a
"drift and snap" effect where markers would float away from their true
locations then jump back when the update triggered.

## Solution
- Added `updateHotspotPositions()` method that synchronizes overlay
positions with the map viewport in real-time during movement
- Bound method to the map `'move'` event for frame-by-frame position
updates during drag operations
- Eliminated the 100ms throttle delay for position calculations during
active map movement

## Changes
- **Added** `updateHotspotPositions()` method for real-time overlay
position synchronization
- **Added** `'move'` event listener to trigger position updates during
map drag/pan
- **Fixed** drifting issue for high-activity and breaking hotspot
markers
- **Added** dev mode helper to force 3 random hotspots as `breaking` for
easier overlay behavior testing (for some reason they just weren't
appearing on localhost)



https://github.com/user-attachments/assets/a1cfe749-69bb-499c-b396-24054e7891ce



https://github.com/user-attachments/assets/59c4265a-0667-4ea9-a657-a4f67f983f1e

- koala73#34: Remove isProUser() guard from setupAuthWidget(). New users now
  see the sign-in button and can create accounts. The guard was
  intentionally deferred; removing it is the stated end-state.

Close stale todos whose fixes already landed in prior PRs:
- koala73#10: inferEntityClassFromName word-boundary regex (already in code)
- koala73#11: entity key collision fix using candidateStateId (already in code)
- koala73#12: priorWorldState threading to writeSimulationPackage (already in code)
- koala73#13: sanitizeForPrompt on simulation builder strings (already in code)
- koala73#14: allForecastIdSet Set-based lookup (already in code)
- koala73#35: algorithms:['RS256'] in jwtVerify (already in auth-session.ts)
- koala73#41: frameworkHash in deduct-situation cache key (already in code)
- koala73#42: isCallerPremium server-side premium gate (already in code)
- koala73#43: SSRF — ALLOWED_AGENTSKILLS_HOSTS + redirect:manual (already fixed)
- koala73#44: sanitizeForPrompt on systemAppend before LLM (already in code)
- koala73#45: systemAppend included in getCacheKey (already in code)
- koala73#49: shippingStress/diseaseOutbreaks/socialVelocity in BOOTSTRAP_KEYS

https://claude.ai/code/session_015fz1MvRuBJGYbgHubGEabA