Add municipality and coordinate search, and a map target selector

Puts the controls that change what the map is looking at over the map itself,
where they act, and gives them something to search.

Search is one field, not two. A string either parses as coordinates or it does
not, and the answer is obvious from the text, so making the user declare up
front which kind of thing they are looking for would be asking them to do the
program's job. Coordinates accept decimal and degrees-minutes-seconds, comma or
space separated, with hemisphere letters — including the Italian O for ovest,
because someone reading an Italian map will type it and silently reading it as
east would put them the wrong side of Greenwich.

The 1180 Piedmont municipalities are bundled rather than geocoded online. The
app is region-scoped, so a list of one region's towns is small enough to ship
(100 KB) and beats a geocoder on every axis that matters: instant, offline, no
API key, no rate limit, and it cannot return a result somewhere the app has no
radar for. Matching folds accents, so "aglie" finds "Agliè", and prefix matches
outrank substring ones — typing "tor" should surface Torino, not the first
alphabetical name that happens to contain those letters.

tool/generate_places.py derives the list from Istat boundary shapefiles
(CC BY 4.0). Two properties of that file cost time and are now written down:
the geometry is UTM 32N rather than degrees, and the DBF is UTF-8 despite one
bilingual Friulian record that makes strict cp1252 fail. A terminal renders
utf-8 and latin-1 output identically, so the encoding cannot be settled by
looking at printed text — it took dumping codepoints. A guard in the generator
and a test against the shipped asset both check for mojibake now, and the guard
caught a real mistake the moment it was written.

The target selector switches between following the device, a saved place, and
the whole region, and the selection doubles as what the app reopens on: "the
place I marked" and "what I see when I open the app" are one idea to the person
using it. Dragging the map while it is following stops the camera chasing them
but leaves that preference alone, because looking somewhere else now is not the
same as changing their mind about next launch.

The position marker and the following are MapLibre's own, driven by
onCameraTrackingDismissed, so there is no second location stream to keep in step
with the map.

A test asserts that all 1180 municipalities fall inside the region bounds, which
is what actually validates the UTM-to-degrees conversion end to end.

Verified on the emulator: the dropdown lists follow, region and both saved
places; "aglie" finds Agliè; "44.3841 7.5426" offers the coordinate jump and
lands on Cuneo at town-reading zoom; selecting follow moves the map to the
device position with the blue dot on it and changes the recentre button to
match.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Nuvolari/docs/data-sources.md

@@ -286,7 +286,38 @@ come from the ARPA zone documentation.
 A captured copy of the live feed is kept as a test fixture so the parser is verified
 against the real document rather than a hand-written approximation.
 
-## 6. Base map — OpenFreeMap
+## 6. Municipalities — Istat boundaries
+
+The 1180 municipalities of Piedmont with a representative point each, bundled as
+`app/assets/regions/piemonte_comuni.json` (98 KB) and generated by
+`tool/generate_places.py`.
+
+**Source**: Istat, *Confini delle unita amministrative a fini statistici*,
+generalised boundaries at 1 January 2025, **CC BY 4.0**.
+`https://www.istat.it/storage/cartografia/confini_amministrativi/generalizzati/2025/Limiti01012025_g.zip`
+
+Bundled rather than geocoded online because the app is region-scoped: the search
+is instant, works with no network, needs no API key, has no rate limit to
+respect, and cannot return a result somewhere the app has no radar for.
+
+Two properties of the source file are worth knowing before touching the
+generator:
+
+- **The shapefile is in WGS84 / UTM zone 32N**, not in degrees. The generator
+  runs an inverse transverse Mercator to get latitude and longitude.
+- **The DBF is mixed-encoding.** It is UTF-8 — "Aglie" ends in a single U+00E8 —
+  but at least one bilingual Friulian record makes strict cp1252 fail, and a
+  terminal renders utf-8 and latin-1 output identically, so this cannot be
+  settled by looking at printed text. The generator asserts that no output name
+  contains the tell-tale mojibake sequences, and a test asserts it again against
+  the shipped asset.
+
+Points are the centroid of each municipality's **largest** part, not of the whole
+shape: several are multipart, and averaging a main body with its exclaves can
+land the point on a neighbour. Expect 1-4 km between the point and the town
+centre, which is well inside what framing a map needs.
+
+## 7. Base map — OpenFreeMap
 
 OpenStreetMap vector tiles served by **OpenFreeMap** (<https://openfreemap.org>).
 
@@ -321,7 +352,7 @@ bounding box — flat background plus the extent outline, no network sources at
 deliberately plain so it is never mistaken for a finished map, and it is what the widget
 tests run against.
 
-## 7. Lightning — out of scope
+## 8. Lightning — out of scope
 
 Not part of the app. If it is ever revisited: **Blitzortung prohibits commercial use**,
 and the DPC `LTG` product is the source to reach for instead.

Nuvolari/docs/licenses.md

@@ -14,6 +14,7 @@ to save screen space.
 | OpenStreetMap data | ODbL | "© OpenStreetMap contributors" | Must stay visible on the map |
 | OpenMapTiles schema | BSD 3-Clause | "© OpenMapTiles" | Must stay visible on the map |
 | OpenFreeMap service | MIT | "OpenFreeMap" — optional | Listed on the Sources screen |
+| Istat municipality boundaries | CC BY 4.0 | "Istat" | Bundled municipality list, commercial use permitted |
 
 ## Share-alike is the constraint that shapes the backend
 

Nuvolari/docs/privacy.md

@@ -48,6 +48,17 @@ Accuracy", and declining it yields **no fix at all** — an absurd outcome for a
 that only ever wanted an approximate one. It also means location works on devices
 without Play Services.
 
+### Following, and continuous updates
+
+Selecting "segui la mia posizione" hands tracking to the map's own location
+component, which receives updates continuously while the app is in the
+foreground. That is more than the single fix everything else needs, so it is
+opt-in, it is visible — the chip at the top of the map says so — and it stops the
+moment the user drags the map away.
+
+It never runs in the background: there is no background location permission and
+no foreground service, so closing the app ends it.
+
 ### The permission flow
 
 - A **prominent disclosure** is shown before the system dialog, as Google Play requires,

Nuvolari/docs/roadmap.md

@@ -78,7 +78,7 @@ and a disk layer belongs with the network adapter, where it would save a real re
 
 ---
 
-## M4 — Saved places and device location ✅
+## M4 — Places, search and device location ✅
 
 A named point the user keeps, used to frame the map and — once notifications exist — to
 anchor them. Stored in `SharedPreferences` on the device and nowhere else.
@@ -104,6 +104,22 @@ A unit test also caught an id collision: ids came straight from the microsecond
 so two places saved in the same microsecond shared an id and rename, remove and the
 duplicate check all acted on the wrong one.
 
+**Extended** with search and a target selector, also verified on the emulator:
+
+- One search field takes either a municipality name or coordinates, because a string
+  either parses as coordinates or it does not and the user should not have to declare
+  which they meant. Accent-insensitive: typing "aglie" finds "Agliè". Coordinates accept
+  decimal and degrees-minutes-seconds, comma or space separated, with hemisphere letters
+  including the Italian **O** for west.
+- The 1180 municipalities are bundled from Istat boundaries rather than geocoded online.
+  A test asserts every one of them falls inside the region bounds, which is what
+  validates the UTM-to-degrees conversion end to end.
+- A dropdown over the map switches between following the device, a saved place, and the
+  whole region; the selection is also what the app reopens on. Dragging the map while it
+  is following stops the camera chasing but leaves that preference alone.
+- The blue position marker and the following are MapLibre's own, so there is no custom
+  location stream to keep in step with the map.
+
 ## M5 — Backend worker ⛔
 
 The critical path. Until this exists, `DpcRadarSource` has nothing to read and the app