security: CORS hardening, path traversal fix, WebSocket auth + cleanup

- Restrict CORS to localhost origins (was allow_origins=[*])
- Require valid JWT on WebSocket /ws (anonymous no longer gets admin view)
- Fix path traversal in delete_cell(): resolve() + parent check
- Validate cell_id format in /charts/download-noaa/{cell_id}
- Exclude charts/ and Cartas/ from git (keep US1GC09M world overview)
- Add NOAA ENC Portal external link in charts catalog tab
- Untrack __pycache__/, .db, .claude/ session files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/services/alert_engine.py

@@ -119,10 +119,15 @@ def evaluate_vessel(vessel, aids, config):
 
     return alerts
 
-def evaluate_aid_movement(aid_id, lat_actual, lon_actual, lat_nominal, lon_nominal, config=None):
-    config = config or {}
-    warn_m  = config.get("displacement_warn_m", 10.0)
-    alarm_m = config.get("displacement_alarm_m", 15.0)
+def evaluate_aid_movement(aid_id, lat_actual, lon_actual, lat_nominal, lon_nominal,
+                          config=None, warn_m=None, alarm_m=None):
+    """
+    warn_m / alarm_m: per-aid override from Aid.displacement_warn_m / alarm_m.
+    If None, falls back to global config values.
+    """
+    config  = config or {}
+    warn_m  = warn_m  if warn_m  is not None else config.get("displacement_warn_m",  10.0)
+    alarm_m = alarm_m if alarm_m is not None else config.get("displacement_alarm_m", 15.0)
     desplazamiento = haversine(lat_actual, lon_actual, lat_nominal, lon_nominal)
     en_movimiento = detect_continuous_movement(aid_id, lat_actual, lon_actual)