Add Wingbits as fallback flight data source when OpenSky fails

- Add /flights and /flights/batch endpoints to wingbits proxy
- Add fetchMilitaryFlightsFromWingbits() to theater-posture API
- Try OpenSky first, fallback to Wingbits on 429/failure
- Transform Wingbits data to match existing flight format
- Add 'source' field to response ('opensky' or 'wingbits')

api/wingbits/[[...path]].js

@@ -137,6 +137,131 @@ export default async function handler(req) {
     }
   }
 
+  // Route: GET /flights - Get live flight positions in a geographic area
+  // Query params: la (lat), lo (lon), w (width), h (height), unit (km|nm)
+  if (path === '/flights' && req.method === 'GET') {
+    try {
+      const params = new URLSearchParams(url.search);
+      const la = params.get('la') || params.get('lat');
+      const lo = params.get('lo') || params.get('lon');
+      const w = params.get('w') || params.get('width') || '500';
+      const h = params.get('h') || params.get('height') || '500';
+      const unit = params.get('unit') || 'nm';
+
+      if (!la || !lo) {
+        return Response.json({ error: 'lat (la) and lon (lo) required' }, {
+          status: 400,
+          headers: { 'Access-Control-Allow-Origin': '*' },
+        });
+      }
+
+      const wingbitsUrl = `https://customer-api.wingbits.com/v1/flights?by=box&la=${la}&lo=${lo}&w=${w}&h=${h}&unit=${unit}`;
+      console.log('[Wingbits] Fetching flights:', wingbitsUrl);
+
+      const response = await fetch(wingbitsUrl, {
+        headers: {
+          'x-api-key': apiKey,
+          'Accept': 'application/json',
+        },
+      });
+
+      if (!response.ok) {
+        const errorText = await response.text();
+        console.error('[Wingbits] API error:', response.status, errorText);
+        return Response.json({
+          error: `Wingbits API error: ${response.status}`,
+          details: errorText,
+        }, {
+          status: response.status,
+          headers: { 'Access-Control-Allow-Origin': '*' },
+        });
+      }
+
+      const data = await response.json();
+      console.log('[Wingbits] Got', Array.isArray(data) ? data.length : 0, 'flights');
+
+      return Response.json(data, {
+        headers: {
+          'Access-Control-Allow-Origin': '*',
+          'Cache-Control': 'public, max-age=30', // 30 seconds - live data
+        },
+      });
+    } catch (error) {
+      console.error('[Wingbits] Flights fetch error:', error);
+      return Response.json({
+        error: `Fetch failed: ${error.message}`,
+      }, {
+        status: 500,
+        headers: { 'Access-Control-Allow-Origin': '*' },
+      });
+    }
+  }
+
+  // Route: POST /flights/batch - Get flights for multiple areas (for theater posture)
+  if (path === '/flights/batch' && req.method === 'POST') {
+    try {
+      const body = await req.json();
+      const areas = body.areas || [];
+
+      if (!Array.isArray(areas) || areas.length === 0) {
+        return Response.json({ error: 'areas array required' }, {
+          status: 400,
+          headers: { 'Access-Control-Allow-Origin': '*' },
+        });
+      }
+
+      // Wingbits batch endpoint format
+      const wingbitsAreas = areas.map(area => ({
+        alias: area.id || area.alias,
+        by: 'box',
+        la: (area.north + area.south) / 2,
+        lo: (area.east + area.west) / 2,
+        w: Math.abs(area.east - area.west) * 60, // degrees to nautical miles (approx)
+        h: Math.abs(area.north - area.south) * 60,
+        unit: 'nm',
+      }));
+
+      const response = await fetch('https://customer-api.wingbits.com/v1/flights', {
+        method: 'POST',
+        headers: {
+          'x-api-key': apiKey,
+          'Accept': 'application/json',
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(wingbitsAreas),
+      });
+
+      if (!response.ok) {
+        const errorText = await response.text();
+        return Response.json({
+          error: `Wingbits API error: ${response.status}`,
+          details: errorText,
+        }, {
+          status: response.status,
+          headers: { 'Access-Control-Allow-Origin': '*' },
+        });
+      }
+
+      const data = await response.json();
+      console.log('[Wingbits] Batch got', data.length, 'area results');
+
+      return Response.json(data, {
+        headers: {
+          'Access-Control-Allow-Origin': '*',
+          'Cache-Control': 'public, max-age=30',
+        },
+      });
+    } catch (error) {
+      console.error('[Wingbits] Batch flights error:', error);
+      return Response.json({
+        error: `Fetch failed: ${error.message}`,
+      }, {
+        status: 500,
+        headers: { 'Access-Control-Allow-Origin': '*' },
+      });
+    }
+  }
+
   // Route: GET /health - Check Wingbits status
   if (path === '/health' || path === '') {
     try {