Map tiles: switch to Esri World Light Gray (OSM 403s file://)

tiles="OpenStreetMap" returned HTTP 403 "referer is required by tile usage
policy" in the target browser — OSM graylists refererless requests and a
karte.html opened via file:// sends no Referer. Esri's Canvas/World_Light_Gray
base + reference layers need neither a key nor a Referer and keep the muted
look. New MAP_TILES / MAP_TILES_LABELS / MAP_TILES_ATTR constants; generate_map
adds them as explicit TileLayers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/dev-notes.md

@@ -36,19 +36,26 @@ Numeric parsing is deliberately deferred to `get_map_data` (`pd.to_numeric(...,
 errors="coerce")`). Don't "fix" columns to float on load — blank coordinates and
 leading-zero PLZ both depend on the string representation.
 
-## CartoDB "positron" tiles now require an API key (2026-09-07)
+## Map tiles: Carto needs a key, OSM 403s file:// — use Esri (2026-09-07)
 
-The original `folium.Map(tiles="CartoDB positron")` started rendering an
-"API KEY REQUIRED / carto.com/basemaps/apikey" watermark – Carto moved its
-basemaps behind a key. Switched to `tiles="OpenStreetMap"` (constant
-`MAP_TILES`), which needs no key. Trade-off: OSM standard tiles are more
-colourful than positron's muted grey. Other no-key options if a lighter look is
-wanted: OSM Germany (`tile.openstreetmap.de`), OSM France Hot
-(`{s}.tile.openstreetmap.fr/hot`) – both still colourful. Truly muted
-key-free basemaps are hard to find now.
+Two dead ends before landing on Esri:
 
-Don't assume a "free" third-party tile source stays free – pin the provider in
-one constant so swapping it is a one-line change.
+1. `folium.Map(tiles="CartoDB positron")` → "API KEY REQUIRED" watermark; Carto
+   moved basemaps behind a key.
+2. `tiles="OpenStreetMap"` → worked in `curl` from the dev machine but the
+   **user's browser got HTTP 403 "referer is required by tile usage policy"**.
+   OSM's tile CDN graylists refererless requests, and a `karte.html` opened as a
+   local `file://` sends no `Referer`. A browser can't add one. Dead end for
+   this app's "open a local HTML file" model.
+
+Now: **Esri "World Light Gray"** base + reference (labels) overlay
+(`server.arcgisonline.com/ArcGIS/rest/services/Canvas/…`). No key, no `Referer`
+check, light/muted look close to the old positron. `MAP_TILES` /
+`MAP_TILES_LABELS` constants; comment lists Esri Street/Topo as swaps.
+
+Lesson: a tile source that works from `curl` or an `http://` page can still fail
+from `file://`. Test the map by **opening the generated `karte.html` directly**,
+not just by checking the URL in the HTML.
 
 ## Nominatim query order matters