Two isolated UX/security fixes from 2026-05-24 audit:
* MapPicker.tsx (#12): add role=dialog, aria-modal, aria-labelledby; trap
Tab/Shift+Tab focus inside modal; Escape closes; restore focus on close.
Pin Leaflet 1.9.4 CSS+JS with sha256 SRI hashes + crossOrigin=anonymous
(defends against unpkg CDN hijack).
* PhotoUpload.tsx (#13): client-side file.size check (10 MB mirror of
backend _MAX_PHOTO_BYTES) prevents wasted bandwidth on oversized uploads.
Replace single error state with per-file errors[] list. Clear stale
errors on every new file pick.
