Animate the radar timeline with a double-buffered overlay

Completes milestone 3: frames render over the map, play as a loop, and can be
scrubbed, with the legend drawn from the manifest rather than a constant that
could drift from what the worker actually rendered.

The overlay alternates two MapLibre image sources. Updating one source in place
flickers, because the layer briefly shows a half-written texture; adding every
frame as its own layer avoids that but pins them all in GPU memory, and twenty
512x512 RGBA frames is about 80 MB. Two buffers cost the same whether the
timeline holds six frames or sixty. Platform-channel work is serialised because
`show` is called faster than the round trip completes during playback, and
overlapping updates would swap visibility out of order and strobe.

Prefetching loads a window around the playhead, nearest first and forward
before backward, since playback moves forward and that frame is needed
soonest. `FrameCache` is byte-budgeted rather than entry-counted because frame
size tracks how much precipitation is on screen, and it evicts by distance from
the playhead: plain LRU would keep frames the prefetcher touched a moment ago
even after the playhead moved to the far end of the timeline.

Also adds DpcRadarSource, which reads published frames from our CDN and never
from the DPC API. Without it, the `dpc` adapter would have had to fall back to
mock, putting demo frames on screen under the label of live data — exactly the
confusion the adapter split exists to prevent. It now fails naming the missing
setting instead.

Running it on the emulator caught three things the tests had not:

- The notifier wrote to `state` from inside `build()`, which Riverpod rejects
  as an uninitialised provider. That broke startup, not just tests.
- Eight-month-old demo frames rendered as "Aggiornato 342535 minuti fa". The
  age formatter now steps up to hours and days.
- Demo mode sat permanently behind a stale-data warning and so never showed the
  working state it exists to demonstrate. MockRadarSource now shifts the
  bundled timestamps onto the present, leaving images, order and spacing
  untouched, so the timeline behaves exactly as it would on live data.

Corrects docs/stack-decisions.md, which described a disk cache that was not
built: mock frames already live in the asset bundle, so a disk layer belongs
with the network adapter where it would save a real request.

Verified: analyze clean, 129 tests passing, and on the emulator the loop
advances, wraps, and reports "Aggiornato ora".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Nuvolari/docs/roadmap.md

@@ -60,7 +60,7 @@ entirely inside the region so the map read as a blank expanse, and the attributi
 sat behind the system gesture pill. Both fixed — the camera now fits the region bounds
 at runtime, which works on any screen size, and the bar is inside a SafeArea.
 
-## M3 — Animation and timeline 🔨
+## M3 — Animation and timeline ✅
 
 `RadarSource` with `MockRadarSource` (synthetic frames in assets) and `DpcRadarSource`.
 Timeline scrubber, play/pause, adjacent-frame prefetch, `FrameCache` LRU, animation
@@ -69,6 +69,23 @@ suspended in background, graceful degradation with a data-age banner.
 **Accepts when:** animation runs smoothly in demo mode **with the network off**, and
 prefetch, LRU eviction and the fallback paths are covered by tests.
 
+**Done and verified on the emulator.** The overlay is double buffered, the timeline
+lands on the newest frame, playback advances and wraps, scrubbing takes over from
+playback, and the legend is drawn from the manifest rather than a constant.
+
+Running it caught three things the tests had not:
+
+- The notifier wrote to `state` from inside `build()`, which Riverpod rejects as an
+  uninitialised provider. This broke startup, not just tests.
+- Eight-month-old demo frames rendered as "Aggiornato 342535 minuti fa". The age
+  formatter now steps up to hours and days.
+- Demo mode sat permanently behind a stale-data warning, so it never showed the
+  working state it exists to demonstrate. `MockRadarSource` now shifts the bundled
+  timestamps onto the present, leaving images, order and spacing untouched.
+
+Frame caching is in memory only for now: mock frames are already in the asset bundle
+and a disk layer belongs with the network adapter, where it would save a real request.
+
 ## M4 — Forecast
 
 `MetNoForecastSource` with the mandatory identifying User-Agent, honouring `Expires`

Nuvolari/docs/stack-decisions.md

@@ -70,14 +70,25 @@ Chosen over: adding all ~20 frames as layers with opacity 0 (constant GPU memory
 matters more than the saved swap — 20 frames at 1024×1024 RGBA is ~80 MB resident),
 and over updating a single source in place (visible flicker during decode).
 
-## Frame cache — custom LRU
+## Frame cache — custom in-memory LRU
 
-`FrameCache` over `path_provider`: an on-disk LRU with a configurable byte cap, plus a
-small in-memory LRU of PNG bytes.
+`FrameCache`: an in-memory LRU of PNG bytes with a byte budget, plus `retainOnly` so
+the timeline can drop everything outside the window around the playhead.
+
+The budget is in bytes rather than entries because frame size tracks how much
+precipitation is on screen — a clear sky compresses to almost nothing, a storm does
+not — so an entry count would let a stormy loop use several times the memory of a calm
+one.
 
 Chosen over `flutter_cache_manager`, which does not expose the eviction control the
-scrubber needs. Prefetch must prioritise frames adjacent to the playhead and evict by
-distance from it, not by age.
+scrubber needs. Plain LRU keeps frames the prefetcher touched a moment ago even after
+the playhead has moved to the far end of the timeline, so eviction is driven by
+distance from the playhead, not by access time.
+
+**Deliberately not persistent.** Mock frames already live in the asset bundle, and
+network frames are re-fetched from the CDN. A disk layer belongs with the network
+adapter, where it would actually save a request, and is worth adding once real CDN
+frames are flowing.
 
 ## Region configuration