fix(geoportal): proxy PMTiles through HTTPS + fix click/selection + optimize rebuild

PMTiles was loaded via HTTP from MinIO (10.10.10.166:9002) on an HTTPS page,
causing browser mixed-content blocking — parcels invisible on geoportal.

Fixes:
- tile-cache nginx proxies /pmtiles/ → MinIO with Range header support
- PMTILES_URL changed to relative path (resolves to HTTPS automatically)
- clickableLayers includes PMTiles fill layers (click on parcels works)
- Selection highlight uses PMTiles source at z13+ (was Martin z17+ only)
- tippecanoe per-layer zoom ranges (terenuri z13-z18, cladiri z14-z18)
  skips processing millions of features at z0-z12 — faster rebuild

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nginx/tile-cache.conf

@@ -37,6 +37,38 @@ server {
     proxy_set_header Host $host;
   }
 
+  # PMTiles from MinIO — HTTPS proxy for browser access (avoids mixed-content block)
+  # Browser fetches: /pmtiles/overview.pmtiles → MinIO http://10.10.10.166:9002/tiles/overview.pmtiles
+  location /pmtiles/ {
+    proxy_pass http://10.10.10.166:9002/tiles/;
+    proxy_set_header Host 10.10.10.166:9002;
+    proxy_http_version 1.1;
+
+    # Range requests — essential for PMTiles (byte-range tile lookups)
+    proxy_set_header Range $http_range;
+    proxy_set_header If-Range $http_if_range;
+    proxy_pass_request_headers on;
+
+    # Browser cache — file changes only on rebuild (~weekly)
+    add_header Cache-Control "public, max-age=3600, stale-while-revalidate=86400" always;
+
+    # CORS — PMTiles loaded from tools.beletage.ro page
+    add_header Access-Control-Allow-Origin "*" always;
+    add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "Range, If-None-Match, If-Range, Accept-Encoding" always;
+    add_header Access-Control-Expose-Headers "Content-Range, Content-Length, ETag, Accept-Ranges" always;
+
+    # Preflight
+    if ($request_method = OPTIONS) {
+      add_header Access-Control-Allow-Origin "*";
+      add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS";
+      add_header Access-Control-Allow-Headers "Range, If-Range";
+      add_header Access-Control-Max-Age 86400;
+      add_header Content-Length 0;
+      return 204;
+    }
+  }
+
   # Tile requests — cache aggressively
   location / {
     proxy_pass http://martin:3000;