Fix 7 bugs: security, memory leak, stale state, error handling

- WebSocket: verify task ownership before allowing subscribe (security)
- POI routes: replace assert with HTTPException for production safety
- cancel_task: return HTTP 404 instead of 200 for missing tasks
- routing_config: add descriptive ValueError for invalid env vars
- POIManager: show error feedback instead of silently swallowing failures
- VisualizationCard: reset POI/travel mode state on metric switch
- Map: clean up heatmap layers/sources on unmount to prevent memory leak
- Update test to expect 404 from cancel_task ownership check

tests/integration/test_api_workflow.py

@@ -296,9 +296,7 @@ async def test_cancel_task_not_owned(
     monkeypatch.setattr("services.task_service.get_user_tasks", lambda email: [])
 
     resp = await async_client.post("/api/cancel_task?task_id=not-mine")
-    assert resp.status_code == 200
-    data = resp.json()
-    assert data["success"] is False
+    assert resp.status_code == 404
 
 
 @pytest.mark.asyncio