Add scenic waypoints for drive legs (OSRM via-routing)

- Transport entries carry an optional ordered waypoints array of
  lat/lng/name points; /route attaches them to the ground leg the
  transport bridges, and /api/directions accepts a via param so the
  drawn road route detours through them
- Day editor gains a geocoded "Scenic waypoints" list on transport
  entries; the map draws leg-coloured waypoint dots
- Escape waypoint names in the Leaflet tooltip (stored-XSS fix flagged
  by security review: names are user-typed and Leaflet renders string
  tooltips as HTML)

public/js/api.js

@@ -73,7 +73,10 @@ export const api = {
     costs: (id) => get(`/api/trips/${id}/costs`),
     regenerateTransports: (id) => post(`/api/trips/${id}/transports/regenerate`, {}),
   },
-  directions: (from, to) => get(`/api/directions?from=${from.lat},${from.lng}&to=${to.lat},${to.lng}`),
+  directions: (from, to, via = []) => get(
+    `/api/directions?from=${from.lat},${from.lng}&to=${to.lat},${to.lng}` +
+    (via.length ? `&via=${via.map((w) => `${w.lat},${w.lng}`).join('|')}` : ''),
+  ),
   entries: {
     create: (tripId, payload) => post(`/api/trips/${tripId}/entries`, payload),
     update: (id, patchBody) => patch(`/api/entries/${id}`, patchBody),