feat(cms-sections): add Google Maps area selector for format: map

[guitavano]

Summary

• Adds a MapField widget that renders an interactive Google Map with a draggable/resizable circle for area selection, mirroring admin/components/ui/Map.tsx. Schema string fields tagged with format: "map" (the convention emitted by MapWidget in deco-apps/admin/widgets.ts) now render the map instead of a plain text input.
• Used by the Location matcher's coordinates field (includeLocations / excludeLocations) so users can pick a center + radius on the map instead of typing "lat,lng,radius" by hand.

Implementation notes

• New apps/mesh/src/web/components/sections-editor/fields/map-field.tsx. React-19-safe (no useEffect): uses a ref-callback with a cleanup return and pins the initial value in a ref so onChange-driven re-renders don't tear down the map mid-drag.
• Routes format === "map" to MapField in schema-form.tsx, alongside the existing image-uri / file-uri / location handlers.
• The Maps JS API key is a runtime server env var (GOOGLE_MAPS_API_KEY), exposed to the client through /api/config — the exact same pattern as POSTHOG_KEY. Read at request time, so it's configurable per environment (dev / staging / prod) without rebuilding the bundle, and belongs in the runtime k8s config (deco-apps-cd), not the build. It's a client-side token by design — the Maps JS API loads in the browser and always ships its key in the request URL, so it can't be hidden and is not a secret; security relies on Google Cloud restrictions (HTTP-referrer allowlist + API restriction to "Maps JavaScript API"). When unset, the field renders an inline "unavailable" note instead of crashing.
• Adds @types/google.maps devDependency; the field file uses a triple-slash reference instead of widening tsconfig.json's types array.

Setup

• Dev: set GOOGLE_MAPS_API_KEY in apps/mesh/.env (read at server runtime).
• Staging / prod: set GOOGLE_MAPS_API_KEY in the runtime env (deco-apps-cd), per environment — same mechanism as DBOS_CONDUCTOR_KEY / POSTHOG_KEY. No CI/build change needed.
• Confirm the key's referrer allowlist in Google Cloud includes the target domains before enabling — without that the map fails to load.

Test plan

• GOOGLE_MAPS_API_KEY set in apps/mesh/.env, then bun run dev.
• Open a variant whose rule is the Location matcher → + Add item under Include Locations → drill in.
• Area selection field renders a Google Map with a blue circle.
• Drag the circle, resize via handles, click elsewhere on the map → the value updates as lat,lng,radius.
• Switching variants / closing & reopening the item restores the map at the saved circle.
• Unset the env var → the field shows the "unavailable" note instead of crashing.
• GET /api/config returns googleMapsApiKey (unit tests cover set/unset).

🤖 Generated with Claude Code