feat(dashboard): console phase 2 - self-hosted basemap, basin stations, markers

- Basemap: src/static/basemap/ping-basin.pmtiles, a Protomaps extract of the
  Ping basin (zoom 0-12, 15 MB, OpenStreetMap data), drawn by
  protomaps-leaflet 5.1.0 (unpkg, SRI) in its light/dark style with labels in
  the page language. It replaces the dimmed OSM raster tiles, whose baked-in
  labels were the noisiest part of the screen; OSM stays as the fallback.
  The browser reads the file with range requests (ServeDir answers 206;
  dev_proxy.py now does too). The map stays within the basin.
- Basin stations: a second list next to the RID gauges and a map layer of
  diamonds, from /api/hii/waterlevel/latest (falling back to
  /sensors/thaiwater), coloured by ThaiWater's bank-height classes (over the
  bank = danger, 70-100 % = watch). Gauges RID already lists appear once.
  The panel shows level (m MSL), % of bank height, distance to and height of
  the bank top, gauge reading and agency; selection in the URL (#hii-<id>).
- custom-markers.json as pins from zoom 12, with the flood zone they are in.

Refresh instructions for the basemap in src/static/basemap/README.md.

tests/test_console.py

@@ -52,7 +52,9 @@ def test_every_fetched_path_is_routed():
 
 
 def test_static_files_it_loads_exist():
-    for path in re.findall(r"/static/([\w./-]+\.(?:geojson|json|woff2))", _html()):
+    for path in re.findall(
+        r"/static/([\w./-]+\.(?:geojson|json|woff2|pmtiles))", _html()
+    ):
         assert (STATIC / path).is_file(), path
 
 
@@ -96,5 +98,19 @@ def test_fonts_are_self_hosted_with_their_licence():
     assert (STATIC / "fonts" / "noto-sans-thai-OFL.txt").is_file()
 
 
+def test_basemap_is_self_hosted():
+    html = _html()
+    assert "/static/basemap/ping-basin.pmtiles" in html
+    assert "protomaps-leaflet@5.1.0" in html and 'integrity="sha384-' in html
+    # the attribution OpenStreetMap's licence requires
+    assert "openstreetmap.org/copyright" in html
+
+
+def test_basin_stations_have_a_fallback_feed():
+    html = _html()
+    assert "fetch('/api/hii/waterlevel/latest')" in html
+    assert "fetch('/sensors/thaiwater')" in html
+
+
 def test_preview_is_not_indexed():
     assert '<meta name="robots" content="noindex">' in _html()