Dynamic avatar rotation

feat(location): push-based source, cache fallback, and a sink service master

Location had a single source, Home Assistant, reachable only over the home LAN. When HA went down the resolver fell straight back to home coordinates and stayed there silently, so the avatar reported home weather with no flag for weeks while its owner was elsewhere. Resolve from the first source that answers instead: a position the phone pushes over the always-on WireGuard tunnel, then HA, then the last known position within a TTL, then home. Weather already followed the resolved coordinates, so it now tracks the phone as well as the flag does. Each run logs which source won, so a silent degradation is visible. src/sink.js is the receiving end: a dependency-free HTTP endpoint run as a second container from the same image, speaking OwnTracks HTTP mode (and plain {lat, lon}), authenticated with a shared token, LAN-only. Coordinates are rounded to coordPrecision before they touch disk. Rejections say which scheme was tried and the shape of what was presented (never the value), and keepAliveTimeout outlives OkHttp's connection reuse window.