Add map-frontend (nginx + MapLibre GL), make pmtiles internal-only

- map-frontend: nginx serves MapLibre GL static app, proxies /tiles/ to pmtiles internally
- pmtiles: remove host port binding (internal to npm-network only), update public-url
- 5 themes: light, dark, grayscale, white, black

map-frontend/nginx.conf

@@ -0,0 +1,18 @@
+server {
+    listen 80;
+
+    # Proxy tile requests to the internal pmtiles server
+    location /tiles/ {
+        proxy_pass http://pmtiles:8080/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    # Serve the static frontend
+    location / {
+        root /usr/share/nginx/html;
+        index index.html;
+        try_files $uri $uri/ =404;
+    }
+}