Tile-Server-Spike: MapLibre-Testseite /maplibre-test (vendored maplibre-gl+pmtiles)

- /maplibre-test rendert bayern.pmtiles per pmtiles-Protokoll, minimaler
  Geometrie-Style (OpenMapTiles-Layer, keine Glyphs), Touren-Demo als GeoJSON-Line
- maplibre-gl 4.7.1 + pmtiles 3.2.1 lokal vendored (CSP script-src 'self')
- CSP: worker-src blob: (MapLibre-Worker)

backend/main.py

@@ -111,6 +111,7 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         response.headers["Content-Security-Policy"]  = (
             "default-src 'self'; "
             "script-src 'self' https://umami.motocamp.de; "          # ohne unsafe-inline/eval — alle Inline-Scripts extrahiert
+            "worker-src blob:; "                                     # MapLibre GL spawnt Web-Worker aus blob-URLs (Tile-Server)
             "style-src 'self' 'unsafe-inline'; "                     # Inline-Styles bleiben (zu viele Fundstellen für jetzt)
             "img-src 'self' data: blob: https:; "
             "connect-src 'self' https:; "
@@ -422,6 +423,12 @@ async def serve_tile(filename: str, request: Request):
     # Kein Range → ganze Datei streamen (pmtiles macht das normalerweise nicht).
     return FileResponse(path, media_type="application/octet-stream", headers=base_headers)
 
+
+@app.get("/maplibre-test")
+async def maplibre_test():
+    # Spike-Testseite: MapLibre rendert /tiles/*.pmtiles (Geometrie-Style, kein Glyph).
+    return FileResponse(os.path.join(STATIC_DIR, "maplibre-test.html"), media_type="text/html")
+
 # User-generierte Medien (Fotos aus Tagebuch, Giftköder-Alarm, etc.)
 MEDIA_DIR = os.getenv("MEDIA_DIR", "/data/media")
 os.makedirs(MEDIA_DIR, exist_ok=True)