Wire AIS end to end: telemetry ingestion + live map overlay

node-26#9, same shape as the ADS-B commit. Adds POST /telemetry/ais
(same node-key auth, same org_id-stamped upsert-by-key pattern, this time
by mmsi into a new `vessels` collection) and its docInMyOrg() firestore
rule. Frontend gets useVessels() (mirrors useAircraft(), longer staleness
window since AIS position reports are minutes apart, not seconds) and an
opt-in "Vessels" map overlay.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infra/firestore/firestore.rules

@@ -102,6 +102,11 @@ service cloud.firestore {
       allow write: if false;
     }
 
+    match /vessels/{mmsi} {
+      allow read: if docInMyOrg();
+      allow write: if false;
+    }
+
     match /alert_events/{alertId} {
       allow read: if docInMyOrg();
       allow write: if false;