feat(maps): add MapLibre OpenFreeMap support (#1317)

Adds MapLibre GL with OpenFreeMap as a tokenless third map provider
alongside Leaflet and Mapbox: a provider abstraction with style presets,
CSP + service-worker entries for tiles.openfreemap.org, and the
map_provider allow-list entry. Mapbox-only APIs stay gated behind the
mapbox provider, and existing Mapbox/Leaflet users are unaffected.

Maintainer review follow-ups folded in: the new map-settings strings are
translated across all locales; the GL engine is lazy-loaded so
Leaflet-only installs don't download it; MapLibre gets its own
maplibre_style slot so switching providers no longer overwrites a custom
Mapbox style; and the MapLibre render path plus the OpenFreeMap
style-guards are covered by tests.

server/src/middleware/globalMiddleware.ts

@@ -114,7 +114,8 @@ export function applyGlobalMiddleware(
           "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
           "https://geocoding-api.open-meteo.com", "https://api.frankfurter.dev",
           "https://router.project-osrm.org/route/v1/", "https://routing.openstreetmap.de/",
-          "https://api.mapbox.com", "https://*.tiles.mapbox.com", "https://events.mapbox.com"
+          "https://api.mapbox.com", "https://*.tiles.mapbox.com", "https://events.mapbox.com",
+          "https://tiles.openfreemap.org"
         ],
         workerSrc: ["'self'", "blob:"],
         childSrc: ["'self'", "blob:"],

server/src/services/settingsService.ts

@@ -16,11 +16,12 @@ export const DEFAULTABLE_USER_SETTING_KEYS = [
   'default_currency',
   'blur_booking_codes',
   'map_tile_url',
-  // Instance-wide Mapbox defaults: an admin can set a shared token + style so the
-  // whole instance uses Mapbox without each user pasting their own key (#920).
+  // Instance-wide GL map defaults: admins can set Mapbox token/style or
+  // tokenless MapLibre/OpenFreeMap style defaults for new users (#920).
   'map_provider',
   'mapbox_access_token',
   'mapbox_style',
+  'maplibre_style',
   'mapbox_3d_enabled',
   'mapbox_quality_mode',
 ] as const;
@@ -32,7 +33,7 @@ const VALID_VALUES: Partial<Record<DefaultableKey, unknown[]>> = {
   distance_unit: ['metric', 'imperial'],
   time_format: ['12h', '24h'],
   dark_mode: [true, false, 'light', 'dark', 'auto'],
-  map_provider: ['leaflet', 'mapbox-gl'],
+  map_provider: ['leaflet', 'mapbox-gl', 'maplibre-gl'],
 };
 
 const BOOLEAN_KEYS = new Set<DefaultableKey>(['blur_booking_codes', 'mapbox_3d_enabled', 'mapbox_quality_mode']);