feat(maps): add Stadia dark + tactical tile providers with API key support

- Add offline.stadia_key to OFFLINE_DEFAULTS in routes/offline.py
- Add stadia_dark and tactical tile providers to Settings.tileProviders
- Update getTileConfig() to inject Stadia API key or fall back to CartoDB dark
- Add setStadiaKey() method for saving and applying the API key
- Show/hide Stadia key row in setTileProvider() and _updateUI()
- Add Stadia options to tile provider select in settings modal
- Add Stadia API key input row to settings modal
- Add TDD tests for stadia_key backend

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_stadia_settings.py

@@ -0,0 +1,41 @@
+import pytest
+
+
+@pytest.fixture
+def auth_client(client):
+    """Client with an authenticated session."""
+    with client.session_transaction() as sess:
+        sess["logged_in"] = True
+    return client
+
+
+def test_offline_settings_includes_stadia_key(auth_client):
+    """GET /offline/settings returns offline.stadia_key field."""
+    resp = auth_client.get("/offline/settings")
+    assert resp.status_code == 200
+    data = resp.get_json()
+    assert "offline.stadia_key" in data["settings"]
+
+
+def test_stadia_key_defaults_to_empty_string(auth_client):
+    """Stadia key defaults to empty string, not None."""
+    # Reset to empty string first to ensure isolation between test runs.
+    auth_client.post("/offline/settings", json={"key": "offline.stadia_key", "value": ""})
+    resp = auth_client.get("/offline/settings")
+    data = resp.get_json()
+    assert data["settings"]["offline.stadia_key"] == ""
+
+
+def test_stadia_key_can_be_saved(auth_client):
+    """POST /offline/settings saves offline.stadia_key."""
+    resp = auth_client.post("/offline/settings", json={"key": "offline.stadia_key", "value": "test-key-123"})
+    assert resp.status_code == 200
+    data = resp.get_json()
+    assert data["value"] == "test-key-123"
+
+
+def test_stadia_key_rejects_non_string(auth_client):
+    """POST /offline/settings rejects non-string stadia_key."""
+    resp = auth_client.post("/offline/settings", json={"key": "offline.stadia_key", "value": 42})
+    # Should coerce to string '42' (type matches str default) — not 400
+    assert resp.status_code == 200