feat(geoportal): nginx tile cache + PMTiles overview layers + tippecanoe pipeline

- Add nginx reverse proxy cache in front of Martin (2GB, 1h TTL, stale serving, CORS)
- Martin no longer exposes host port — all traffic routed through tile-cache on :3010
- Add PMTiles support in map-viewer.tsx (conditional: NEXT_PUBLIC_PMTILES_URL env var)
  - When set: single PMTiles source for UAT + administrativ layers (z0-z14, ~5ms/tile)
  - When empty: fallback to Martin tile sources (existing behavior, zero breaking change)
- Add tippecanoe Docker service (profiles: tools) for on-demand PMTiles generation
- Add rebuild-overview-tiles.sh: ogr2ogr export → tippecanoe → MinIO atomic upload
- Install pmtiles npm package for MapLibre protocol registration

Performance impact:
- nginx cache: 10-100x faster on repeat tile requests, zero PostGIS load on cache hit
- PMTiles: sub-10ms overview tiles, zero PostGIS load for z0-z14

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

package-lock.json

@@ -25,6 +25,7 @@
         "next-auth": "^4.24.13",
         "next-themes": "^0.4.6",
         "nodemailer": "^7.0.13",
+        "pmtiles": "^4.4.0",
         "proj4": "^2.20.3",
         "qrcode": "^1.5.4",
         "radix-ui": "^1.4.3",
@@ -10806,6 +10807,15 @@
         "pathe": "^2.0.3"
       }
     },
+    "node_modules/pmtiles": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/pmtiles/-/pmtiles-4.4.0.tgz",
+      "integrity": "sha512-tCLI1C5134MR54i8izUWhse0QUtO/EC33n9yWp1N5dYLLvyc197U0fkF5gAJhq1TdWO9Tvl+9hgvFvM0fR27Zg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "fflate": "^0.8.2"
+      }
+    },
     "node_modules/pngjs": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-5.0.0.tgz",