feat(train): the instance's own map tiles, drawn by Train's style (ADR 0030, D50)

Protomaps' basemap cut for Europe and served by pmtiles beside Train's server
(compose.maps.yaml), drawn by Train's own style, light and dark, which the
server serves. Only people signed in get tiles: map.source hands a key that
Caddy has the server check before each tile; nothing logs a tile.

Also fixes .dockerignore, which left apps/train/ out of the build context, so
Train's server's and BRouter's images couldn't have been built.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/maps/Dockerfile

@@ -0,0 +1,22 @@
+# The instance's own map tiles (Halkyon Train's ADR 0030, D50): go-pmtiles, checked
+# against GitHub's SHA-256 of its release, serving the region's cut of Protomaps'
+# basemap, and cutting it anew each month (tiles.sh). Built from the repository root:
+#
+#   docker build -f deploy/maps/Dockerfile .
+FROM alpine:3.22
+
+# go-pmtiles v1.31.2, released 22 Jul 2026 (BSD-3-Clause).
+ADD --checksum=sha256:3ed7dbf4ec2e6dfe5e25b6f70d1ffc932729f93c86db353bf514dd71010a312f \
+  https://github.com/protomaps/go-pmtiles/releases/download/v1.31.2/go-pmtiles_1.31.2_Linux_x86_64.tar.gz /tmp/pmtiles.tar.gz
+RUN apk add --no-cache curl ca-certificates \
+ && mkdir -p /app \
+ && tar -xzf /tmp/pmtiles.tar.gz -C /app pmtiles \
+ && rm /tmp/pmtiles.tar.gz
+COPY --chmod=755 deploy/maps/tiles.sh /app/tiles.sh
+
+ENV PATH="/app:$PATH"
+EXPOSE 8080
+
+# The tiles in /tiles (a volume), `/<name>/{z}/{x}/{y}.mvt` for each `<name>.pmtiles`;
+# no TileJSON (Train's style names the tiles itself), no CORS (no browser asks).
+CMD ["pmtiles", "serve", "/tiles", "--port", "8080", "--cache-size", "256"]