feat(map): self-hosted PMTiles map tiles, remove alert toast spam

- Replace OpenStreetMap CDN with self-hosted Protomaps PMTiles
  (Wisconsin + Florida regional extracts, served from nginx)
- Add protomaps-leaflet for vector tile rendering in dark theme
- Update CSP to remove openstreetmap.org, add blob: for vector workers
- Add nginx location block for /tiles/ with byte range support
- Mount tiles directory as volume (not baked into image)
- Remove alert_fired/alert_resolved toast notifications that spammed
  "undefined" at fleet scale — dashboard still updates via query invalidation
- Add *.pmtiles to .gitignore (large binaries)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infrastructure/docker/nginx-spa.conf

@@ -23,7 +23,7 @@ server {
 
     # CSP for React SPA with Tailwind CSS and Leaflet maps
     # worker-src required for SRP key derivation Web Worker (Safari won't fall back to script-src)
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.tile.openstreetmap.org; font-src 'self'; connect-src 'self' ws: wss:; worker-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' ws: wss:; worker-src 'self' blob:; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always;
 
     # Proxy API requests to the backend service
     # The api container is reachable via Docker internal DNS as "api" on port 8000
@@ -91,6 +91,16 @@ server {
         add_header X-Content-Type-Options "nosniff" always;
     }
 
+    # Serve PMTiles with byte range support (protomaps-leaflet reads via HTTP Range)
+    location /tiles/ {
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        types {
+            application/octet-stream pmtiles;
+        }
+        try_files $uri =404;
+    }
+
     # Serve static assets with long cache headers
     # Note: add_header in a location block clears parent-block headers,
     # so we re-add the essential security header for static assets.