Add forensics & analytical geolocation: resection, reverse-heading, horizon, tz-crosscheck, fingerprinting, batch triage/timeline

[cognis-digital]

Summary

Adds geolens.forensics — an offline, standard-library-only layer of defensive analytical geolocation that multiplies what the toolkit can do for verification / OSINT / IR analysts. Everything is additive: the existing public API is unchanged and every new symbol is re-exported from the geolens package.

Scope: verification / analysis / defense only. No targeting, no network, no side effects — plain dicts in and out.

New capabilities

• Geodesy — haversine_km, initial_bearing, destination_point, and resection (recover an observer position from two landmarks + the bearing to each; recovers a synthetic observer to within a few metres, with a residual_km quality figure).
• Reverse heading — reverse_heading: true bearing to a landmark from its pixel position + lens FOV, using the rectilinear (pinhole) projection so frame edges are handled correctly.
• Horizon / terrain cues — horizon_distance_km, max_visible_distance_km, is_peak_visible: refraction-corrected geometry for a "could this peak even be seen from here?" falsification test.
• Timezone cross-check — timezone_crosscheck: EXIF local clock vs GPS-UTC → implied UTC offset → longitude band; flags an image whose GPS longitude is inconsistent with its own clock (edited timestamp / transplanted GPS).
• Camera fingerprint consistency — camera_fingerprint, fingerprint_consistency: tamper/splice signals across a set (mixed makes/models, editing-software tag, dimension drift).
• Batch triage + clustering — cluster_locations, batch_triage: single-linkage spatial clustering + geotagged-vs-scrubbed folder triage.
• Movement timeline — build_timeline, timeline_to_geojson: time-ordered timeline with per-leg distance / elapsed / implied speed, exported as a GeoJSON Point series + LineString track.

CLI

New subcommands: resect, heading, horizon, tzcheck, fingerprint, triage, timeline. horizon / tzcheck / fingerprint exit 3 on a detected inconsistency (scriptable gate).

Demos & docs

• demos/21_resection_and_horizon.py — metadata-free geolocation + falsification.
• demos/22_batch_triage_timeline.py — folder → clusters + movement timeline (GeoJSON) + fingerprint tamper flag.
• New docs/FORENSICS.md; README feature list + demo table + docs/DEMOS.md updated.

Both demos run offline and exit 0 (PYTHONUTF8=1 on Windows).

Tests

python -m pytest -q: 161 → 205 passing (new tests/test_forensics.py + forensics CLI-edge cases). Resection accuracy, rectilinear reverse-heading, horizon falsification, timezone consistency/spoof detection, fingerprint flags, clustering, and timeline ordering/GeoJSON are all covered.