Publish coverage in latest.json so the app can stop offering charts where none exist

The app-integration branch (wingover `feat/vfr-sectional-poc`) resolves everything else it needs from `latest.json`; coverage is the one fact it still fakes with a constant. Decision from the 2026-07-30 app review: the client will never hand-author region boxes (that pattern is this project's recurring defect class), so geographic gating waits on the manifest.

## What the app does today without it

- It requests tiles inside one near-global box (lon -180..180, lat -15.5..72.5). No tighter single box exists: the product spans the antimeridian (Marianas 145E to Virgin Islands 60W) and Samoa 14S to Point Barrow 72N.
- The chart view is offered everywhere the browser can decode JXL. A pilot in Europe gets a "chart" mode that draws nothing over the street base (tiles 404, both renderers draw transparent). Accepted for the USA-only launch, but it reads as broken.

## What the manifest should carry

Coverage for each release object (`current` and `next`), with these properties:

1. **Derived from the bake inputs, not hand-authored.** The pipeline knows exactly which charts it rasterized; coverage should fall out of that set.
2. **Antimeridian-safe.** Either multiple lon-lat boxes (a box list handles the split naturally) or a GeoJSON MultiPolygon. A list of boxes is enough.
3. **Coarse is fine.** The app uses it to gate tile requests and whether the chart mode is offered at all, not to clip rendering. Chart-outline fidelity is unnecessary.
4. **Optional in the contract.** Older manifests without the field keep today's behavior (near-global request box, mode offered everywhere), so it can ship whenever without coordinating an app release.

## What the app will do with it

- Stop requesting tiles outside coverage (today it asks for a lot of ocean and the server 404s by design).
- Stop offering the chart view when the viewport holds no coverage, so the mode simply is not there where it means nothing.

Related open questions from the same review, if they want issues of their own: the CORS allowlist is exact-origin and http-only for localhost (https://localhost:5173 gets no ACAO header and silently kills dev against the real host), and `tilePixels` is published but nothing reads it.