area_context v2 + Maps place verification (server-26#36, #37)

#36 — the correction pass shipped in 58efdbd was right, its reference-data
shape was not. One shape now, at both scopes, every field nullable:

  area_context: { municipality?, county?, state?,
                  center?, radius_km?, resolved_from?, resolved_at?,
                  local_knowledge?: [{term, meaning}] }

`state` closes the ambiguity that made "Ossining" a national guess.
`local_knowledge` replaces roads[]/landmarks[], which could not hold
intersections, schools or nicknames and carried no meanings — `11-X-ray` is
useless alone, `11-X-ray — MTA PD patrol unit` is what a corrector can act on.
Pre-#36 roads[]/landmarks[] are read forward as bare terms so nothing an
operator already entered is lost.

Nullability is the mechanism: which scope gets filled is the operator's
declaration of how homogeneous the system is. One town — fill it once at system
level. Statewide — leave it blank and fill each talkgroup.

The backend owns the derived anchor. PUT /systems/{id} merges config.talkgroups[]
against what is stored instead of writing the client's blob verbatim, which
would have erased the anchor and the pending queue — the same defect as the
ten_codes wipe.

#37 — Maps as a verifier, not as prompt stuffing. The corrector emits its
location nouns; each is geocoded against the talkgroup's anchor, and on a miss
we look for a sound-alike that does resolve there, correct to it, and propose
{term, meaning} to that talkgroup. Cost scales with location nouns, not calls.

No anchor means SKIP. An area too wide to discriminate stores no anchor at all,
because a statewide radius would confirm anything inside it — verification that
passes everything is worse than none, since it reads as a check in the data.

Also re-anchors _geocode_location, which rejected results >40km from the NODE
(server-26#6). An antenna is not a jurisdiction; distance-from-node was always
a stand-in for the anchor and is now only the fallback.

The induction loop proposes at talkgroup level and never promotes. Blast
radius: a wrong term on a channel misleads that channel, the same term
system-wide misleads one 400km away on a statewide system.

38 new tests; 240 pass. Frontend typechecks clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

drb-c2-core/app/config.py

@@ -57,6 +57,19 @@ class Settings(BaseSettings):
     # a property of the audio, and discarding on the first bad roll threw away a
     # recoverable transcript.
     stt_retry_on_degenerate: bool = True
+    # Place verification (server-26#37). Checks the corrector's location nouns
+    # against the talkgroup's own anchor instead of stuffing every road in town
+    # into the prompt, so cost scales with location nouns rather than call volume.
+    place_verification_enabled: bool = True
+    place_verify_max_per_call: int = 3
+    # How close a candidate has to sound before it may rewrite a transcript.
+    # Below this, Places Text Search will confidently hand back the nearest
+    # business for any garbage string.
+    place_soundalike_min_ratio: float = 0.6
+    # An anchor wider than this is not stored at all. A statewide radius would
+    # confirm any location inside it, so the check would rubber-stamp everything
+    # while appearing to work — absent anchor means SKIP, never "accept anything".
+    area_anchor_max_radius_km: float = 60.0
     summary_interval_minutes: int = 2          # how often the summary loop runs
     correlation_window_hours: int = 2          # slow/location path: max hours since last call
     embedding_similarity_threshold: float = 0.93  # slow-path: requires location corroboration