feat(train): the instance's own map tiles, drawn by Train's style (ADR 0030, D50)

Protomaps' basemap cut for Europe and served by pmtiles beside Train's server
(compose.maps.yaml), drawn by Train's own style, light and dark, which the
server serves. Only people signed in get tiles: map.source hands a key that
Caddy has the server check before each tile; nothing logs a tile.

Also fixes .dockerignore, which left apps/train/ out of the build context, so
Train's server's and BRouter's images couldn't have been built.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/sidecars/train.caddy

@@ -1,10 +1,18 @@
-# Halkyon Train's site (compose.train.yaml, ADR 0030, D46): its API server alone. Its
-# web server (8082) takes only the register's calls between the instance's services
-# (`/halkyon-base/…`, ADR 0016), on the instance's own network, never through here.
+# Halkyon Train's site (compose.train.yaml, ADR 0030, D46): its API server, and its own
+# map where compose.maps.yaml switches it on (D50). Its web server (8082) takes the
+# register's calls between the instance's services (`/halkyon-base/…`, ADR 0016) on the
+# instance's own network, never through here; through here only the map's style and
+# the tiles' check (train-maps.caddy).
 {$TRAIN_DOMAIN} {
 	encode zstd gzip
 
+	# Train's own map where compose.maps.yaml mounts it (train-maps.caddy); none
+	# without.
+	import /etc/caddy/train/*.caddy
+
 	# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
 	# The visitor's address comes last in X-Forwarded-For, as for Learn's server.
-	reverse_proxy train-server:8080
+	handle {
+		reverse_proxy train-server:8080
+	}
 }