feat(train): the instance's own map tiles, drawn by Train's style (ADR 0030, D50)

Protomaps' basemap cut for Europe and served by pmtiles beside Train's server
(compose.maps.yaml), drawn by Train's own style, light and dark, which the
server serves. Only people signed in get tiles: map.source hands a key that
Caddy has the server check before each tile; nothing logs a tile.

Also fixes .dockerignore, which left apps/train/ out of the build context, so
Train's server's and BRouter's images couldn't have been built.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/sidecars/train-maps.caddy

@@ -0,0 +1,14 @@
+# Halkyon Train's own map (compose.maps.yaml, ADR 0030, D50), inside Train's site
+# (train.caddy imports it): Train's style, public, from its web server; and the tiles,
+# each passed on only once Train's server takes the key it came with
+# (`Authorization: Bearer`, /map/tile-key: 204 or 401). Caddy logs no request.
+handle /map/style/* {
+	reverse_proxy train-server:8082
+}
+
+handle_path /tiles/* {
+	forward_auth train-server:8082 {
+		uri /map/tile-key
+	}
+	reverse_proxy map-tiles:8080
+}