feat(geoportal): nginx tile cache + PMTiles overview layers + tippecanoe pipeline

- Add nginx reverse proxy cache in front of Martin (2GB, 1h TTL, stale serving, CORS)
- Martin no longer exposes host port — all traffic routed through tile-cache on :3010
- Add PMTiles support in map-viewer.tsx (conditional: NEXT_PUBLIC_PMTILES_URL env var)
  - When set: single PMTiles source for UAT + administrativ layers (z0-z14, ~5ms/tile)
  - When empty: fallback to Martin tile sources (existing behavior, zero breaking change)
- Add tippecanoe Docker service (profiles: tools) for on-demand PMTiles generation
- Add rebuild-overview-tiles.sh: ogr2ogr export → tippecanoe → MinIO atomic upload
- Install pmtiles npm package for MapLibre protocol registration

Performance impact:
- nginx cache: 10-100x faster on repeat tile requests, zero PostGIS load on cache hit
- PMTiles: sub-10ms overview tiles, zero PostGIS load for z0-z14

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tippecanoe.Dockerfile

@@ -0,0 +1,16 @@
+FROM ghcr.io/felt/tippecanoe:latest AS tippecanoe
+FROM osgeo/gdal:alpine-normal-latest
+
+# Copy tippecanoe binary from felt image
+COPY --from=tippecanoe /usr/local/bin/tippecanoe /usr/local/bin/tippecanoe
+COPY --from=tippecanoe /usr/local/bin/tile-join /usr/local/bin/tile-join
+
+# Install MinIO client
+RUN apk add --no-cache curl && \
+    curl -fsSL https://dl.min.io/client/mc/release/linux-amd64/mc -o /usr/local/bin/mc && \
+    chmod +x /usr/local/bin/mc
+
+COPY scripts/rebuild-overview-tiles.sh /opt/rebuild.sh
+RUN chmod +x /opt/rebuild.sh
+
+ENTRYPOINT ["/opt/rebuild.sh"]