feat(lookup): read QRZ's island reference and fill the IOTA award

QRZ's XML carries <iota>EU-048</iota> for an operator on an island, and OpsLog
read past it. Wired end to end: the provider, the lookup cache (a column, like
web and zip before it), and the entry's award references.

It matters more here than the same field would for another award. There is no
live "who is on an island right now" feed anywhere — POTA has one and that is
what OpsLog matches spots against; SOTA has one behind conditions; IOTA
publishes only static lists. So the callbook record is the practical source, and
it is known BEFORE the contact is logged, which is when a reference is useful.

The reference goes in as an IOTA award reference, exactly as one picked by hand,
so the existing path carries it to the qso.iota column on save.

Two limits, both deliberate. A reference the operator typed or picked WINS: a
callbook entry can be years out of date, and the operator in front of the radio
has just been told where the station is. And the value must look like an IOTA
reference — two letters, a hyphen, three digits — because writing anything else
into the award makes a reference no list contains, which counts for nothing and
has to be found by hand later.

frontend/src/lib/awardRefs.ts

@@ -192,3 +192,27 @@ export function spotRefList(byCode: Record<string, string>, fieldOf: Record<stri
   }
   return out.sort((a, b) => a.length - b.length || a.localeCompare(b));
 }
+
+// withIOTARef adds an island reference from the callbook to an entry's award
+// references, unless the operator has already set one.
+//
+// QRZ sends <iota> for an operator on an island and OpsLog used to read past it.
+// It matters more here than it would for another award: unlike POTA there is no
+// live "who is on an island right now" feed anywhere, so the callbook record is
+// the practical source — and it is known before the contact is logged, which is
+// when it is useful.
+//
+// A reference the operator typed or picked wins. A callbook entry can be years
+// old, and the operator in front of the radio has just been told where the
+// station is.
+export function withIOTARef(awardRefs: string, iota: string): string {
+  const ref = (iota || '').trim().toUpperCase();
+  // EU-048: two letters, a hyphen, three digits. Anything else is not an IOTA
+  // reference, and writing it into the award would make a reference that no
+  // list contains — which counts for nothing and has to be found by hand later.
+  if (!/^[A-Z]{2}-\d{3}$/.test(ref)) return awardRefs;
+  const byCode = parseAwardRefs(awardRefs);
+  if ((byCode['IOTA'] ?? '').trim() !== '') return awardRefs; // already set: leave it
+  const sep = awardRefs.trim() === '' ? '' : ';';
+  return awardRefs + sep + 'IOTA@' + ref;
+}