Fix XSS, validation, and CSS regressions; refactor proxy retry logic

- Sanitize geocode suggestion rendering to prevent XSS
- Add lat/lon validation and cache eviction to weather proxy endpoints
- Extract shared fetchWithRetry helper, dedupe retry/timeout logic
- Stop leaking upstream error details to clients
- Fix radar provider metadata and drop dead nowcast field
- Fix missing --surface-radius-sm var and duplicate/conflicting CSS rules

app/public/index.html

@@ -77,7 +77,7 @@
         </div>
         <div class="hero-center">
           <div class="hero-temp"><span id="cur-temp">--</span><span class="deg">°F</span></div>
-          <div class="feels">Feels like <span id="cur-feels">--</span>°F</div>
+          <div class="feels" id="feels-line">Feels like <span id="cur-feels">--</span>°F</div>
           <button id="share-hero-btn" class="hero-share-btn" type="button">Share hero card</button>
           <p id="share-hero-status" class="hero-share-status hidden"></p>
         </div>