map: hot-reload back to MapKit when connectivity is verified (+ Fly-page camera preservation)

Follow-on to #166, which deliberately left this out.

#166 guarantees the **track** always draws. It does not get MapKit back: once MapKit fails at boot and `MapCanvas.createBackend` falls through to MapLibre, the session stays on MapLibre. Reconnecting restores a MapLibre basemap, never Apple's.

Two related gaps make the automatic version worth doing:
- A style that **loads** while its tiles die shows an empty basemap. Only upgrading on *verified* connectivity avoids landing there.
- `MapCanvas` records nothing about which backend was actually built — `MapView` has no backend field and `SettingsPage.tsx:253` shows the stored *setting*, so a silent fallback is invisible to the pilot.

## Constraints (from the audit of #166 — do not skip these)

**Do not verify with `loadMapKit()`.** It memoises success (`mapkit/loader.ts:32`, `ready ??=`) and only clears on rejection, so it is a real probe exactly once per session. Since `createBackend` catches *any* throw, a cache-served "verified" would bump `epoch`, fail again, and loop — rebuilding a GL map each time on a device this repo documents as jetsammed at 500-850 MB. Use an uncached probe, bounded backoff, and a same-failure latch.

**`LiveTrackMap` does not honour `restoredCamera`.** Every other page does (`PlanPage:242`, `FlightDetailPage:283`, `FlightSeat:131`, `AllFlightsMapPage:91`), but `LiveTrackMap.tsx:224` unconditionally `moveTo`s to saved view state. So "camera unchanged across a Fly-page swap" fails by construction until that is fixed — part of this work, not a precondition.

**Two triggers, not one.** A pilot-initiated swap from Settings is ungated and is what the camera test measures. The automatic verified-restore upgrade should be gated off during recording, since a swap tears down and rebuilds the live map. Note `epoch` is per-instance (`MapCanvas.tsx:96`) and tab pages stay mounted, so a global "upgrade now" signal would re-create every mounted map at once.

## Requested test (owner)

A Fly-page drill: hot-swap the provider mid-flight and assert the camera is **identical** — centre, zoom, bearing — with zero interaction and no reframe, track still drawn.

Caveat on shape: MapKit's `__map` exposes only `{getBearing}` (`mapkit/adapter.ts:205-207`) and MapKit needs a token CI does not have, so assert the camera across a MapLibre→MapLibre re-create in CI and verify the MapKit leg on device.