fix(offline): the osm-de and stadia prefetch was CSP-blocked and the opening view stayed grey (#2180)

connect-src never listed tile.openstreetmap.de or tiles.stadiamaps.com, so every prefetch fetch was refused before the service worker saw it, while the swallowed error still counted as a cached tile. Both hosts are allowed now and only reached tiles count. The prefetch rectangle is also widened to the screen the fitBounds view fills, on the raster and the vector path alike; the places extent alone left grey bands beside a north-south trip.

server/src/middleware/globalMiddleware.ts

@@ -198,6 +198,11 @@ export function applyGlobalMiddleware(
           // retired the a/b/c/d shards (#1733). The sharded hosts stay listed
           // for tile templates users saved before that.
           "https://tile.openstreetmap.org", "https://*.tile.openstreetmap.org",
+          // The other two raster presets TREK ships. `mode: 'no-cors'` relaxes
+          // CORS, not CSP, so without these the tile prefetch is refused in the
+          // document and never reaches the Service Worker that would cache it
+          // (#2180). routing.openstreetmap.de below is a different host.
+          "https://tile.openstreetmap.de", "https://tiles.stadiamaps.com",
           "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
           "https://geocoding-api.open-meteo.com", "https://api.frankfurter.dev",
           "https://router.project-osrm.org/route/v1/", "https://routing.openstreetmap.de/",