fix(maps): let users and admins enter a CARTO API key (#2060)

CARTO stamps an "API KEY REQUIRED" watermark onto every basemap tile
fetched without a key since 26.08.2026, and both CartoDB presets plus the
built-in fallback are CARTO. The key is free and needs no account, so add
it as a setting rather than dropping the provider.

carto_api_key sits next to mapbox_access_token: per user in Settings/Map,
instance-wide under Admin/User Defaults, encrypted at rest, injected from
CARTO_API_KEY on managed instances. Unlike Mapbox it never switches the
map provider, since a raster key says nothing about the renderer.

The key is appended as ?key= at render time instead of being stored in the
template, so a saved URL stays portable and survives a rotation. That is
also what reaches the four maps that pinned CARTO and ignored the user's
tile setting: atlas, collections, the public trip share and the public
journey. The two share pages read it from their token-gated payload, the
same way baseCurrency already travels.

Also lifts the release notice above page chrome. Its overlay sat at
z-index 50, under the Vacay mode toolbar at 61, so the dialog was neither
on top nor modal. Adds a six-step layer scale to index.css and moves the
three notice shells onto it.

Closes #2054
Closes #2052

client/src/theme/README.md

@@ -32,6 +32,25 @@ free **if they follow the contract below**.
 | Overlay / inverse | `--overlay` · `--bg-inverse` / `--text-inverse` · `bg-inverse text-inverse-text` |
 | Type tiers | `text-title` / `text-subtitle` / `text-body` / `text-caption` (scale with the user's per-tier multipliers) |
 
+## Layering
+
+Fixed and sticky surfaces read their stacking order from one scale in
+`src/index.css`, so two of them cannot end up in the wrong order by accident.
+
+| Token | Value | For |
+| --- | --- | --- |
+| `--z-bar` | 60 | `BottomNav`, page-bound sticky bars |
+| `--z-nav` | 200 | the desktop navbar |
+| `--z-modal` | 10000 | `shared/Modal`, `ConfirmDialog` |
+| `--z-overlay` | 99990 | page-owned full-screen overlays |
+| `--z-notice` | 99998 | app-wide system and release notices |
+| `--z-toast` | 100000 | toasts, tooltips, context menus |
+
+A new fixed surface docks onto the step it belongs to (`z-[var(--z-modal)]` as a
+class, `z-index: var(--z-modal)` in CSS) instead of inventing a number. Older
+files still carry literal values; the steps are far enough apart that those keep
+their current position until the file gets converted.
+
 ## The contract (enforced by `npm run theme:lint`)
 
 1. **Surfaces/text/borders** use the semantic utilities (`bg-surface*`,