Add runtime CARTO_API_KEY for basemap tiles

CARTO now requires an API key for its basemap tiles; without one every
tile in the DEFAULT dark/light map carries an "API KEY REQUIRED"
watermark. The tile URLs were hardcoded in mapStyles.ts with no way to
supply a key, and because the frontend ships as a prebuilt image a
NEXT_PUBLIC_ variable would be baked in empty for every Docker user.

- New frontend-local route GET /api/basemap-config reads CARTO_API_KEY
  from the frontend container's environment at request time (same
  pattern as BACKEND_URL), so no image rebuild is needed.
- useBasemapConfig() fetches it once per page load; MaplibreViewer
  builds the MapLibre style from it via buildBasemapStyle(theme, key)
  and defers the map's first style load until the config has settled,
  avoiding a burst of unkeyed tile requests followed by a style swap.
- Tile URLs move to CARTO's documented rastertiles/ path with ?key=
  appended when configured. Unkeyed URLs serve byte-identical tiles to
  the old path, so deployments without a key behave exactly as before.
- CARTO_API_KEY wired through docker-compose.yml and documented in
  .env.example, README (data source table + frontend env table) and
  docs/OUTBOUND_DATA.md.
- Tests cover the route (unset / set / trimmed) and the style builder.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.env.example

@@ -27,6 +27,12 @@ AIS_API_KEY=
 # Windy Webcams global CCTV layer — free key from https://api.windy.com/webcams/docs
 # WINDY_API_KEY=
 
+# CARTO basemap tiles (DEFAULT dark/light map). CARTO now requires an API key;
+# without one the map still loads but every tile carries an "API KEY REQUIRED"
+# watermark. Free key (no CARTO account needed, 5M tiles/month fair use):
+# https://carto.com/basemaps/apikey — used by the frontend container only.
+# CARTO_API_KEY=
+
 # Telegram OSINT map layer — scrapes public t.me/s channel previews (no bot token).
 # TELEGRAM_OSINT_ENABLED=true
 # TELEGRAM_OSINT_CHANNELS=osintdefender,insiderpaper,aljazeeraenglish,nexta_live,war_monitor