feat(geoportal): nginx tile cache + PMTiles overview layers + tippecanoe pipeline

- Add nginx reverse proxy cache in front of Martin (2GB, 1h TTL, stale serving, CORS)
- Martin no longer exposes host port — all traffic routed through tile-cache on :3010
- Add PMTiles support in map-viewer.tsx (conditional: NEXT_PUBLIC_PMTILES_URL env var)
  - When set: single PMTiles source for UAT + administrativ layers (z0-z14, ~5ms/tile)
  - When empty: fallback to Martin tile sources (existing behavior, zero breaking change)
- Add tippecanoe Docker service (profiles: tools) for on-demand PMTiles generation
- Add rebuild-overview-tiles.sh: ogr2ogr export → tippecanoe → MinIO atomic upload
- Install pmtiles npm package for MapLibre protocol registration

Performance impact:
- nginx cache: 10-100x faster on repeat tile requests, zero PostGIS load on cache hit
- PMTiles: sub-10ms overview tiles, zero PostGIS load for z0-z14

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -58,6 +58,8 @@ services:
       - ILOVEPDF_PUBLIC_KEY=${ILOVEPDF_PUBLIC_KEY:-}
       # Martin vector tile server (geoportal)
       - NEXT_PUBLIC_MARTIN_URL=https://tools.beletage.ro/tiles
+      # PMTiles overview tiles from MinIO (empty = use Martin for all layers)
+      - NEXT_PUBLIC_PMTILES_URL=${NEXT_PUBLIC_PMTILES_URL:-}
       # DWG-to-DXF sidecar
       - DWG2DXF_URL=http://dwg2dxf:5001
       # Email notifications (Brevo SMTP)
@@ -107,8 +109,39 @@ services:
       dockerfile: martin.Dockerfile
     container_name: martin
     restart: unless-stopped
-    ports:
-      - "3010:3000"
+    # No host port — only accessible via tile-cache nginx proxy
     command: ["--config", "/config/martin.yaml"]
     environment:
       - DATABASE_URL=postgresql://architools_user:stictMyFon34!_gonY@10.10.10.166:5432/architools_db
+
+  tile-cache:
+    build:
+      context: .
+      dockerfile: tile-cache.Dockerfile
+    container_name: tile-cache
+    restart: unless-stopped
+    ports:
+      - "3010:80"
+    depends_on:
+      - martin
+    volumes:
+      - tile-cache-data:/var/cache/nginx/tiles
+
+  tippecanoe:
+    build:
+      context: .
+      dockerfile: tippecanoe.Dockerfile
+    container_name: tippecanoe
+    profiles: ["tools"]
+    environment:
+      - DB_HOST=10.10.10.166
+      - DB_PORT=5432
+      - DB_NAME=architools_db
+      - DB_USER=architools_user
+      - DB_PASS=stictMyFon34!_gonY
+      - MINIO_ENDPOINT=http://10.10.10.166:9002
+      - MINIO_ACCESS_KEY=admin
+      - MINIO_SECRET_KEY=MinioStrongPass123
+
+volumes:
+  tile-cache-data: