Maps still fall back to hard-coded CARTO tiles instead of the configured provider #332

Since August 2026, CARTO requires a Basemaps API key on raster tile requests. Requests without a key still return HTTP 200, but every tile is stamped "API KEY REQUIRED". Some maps still fall back to hard-coded CARTO URLs instead of the operator's configured tile provider, so they show stamped tiles even on instances configured for Esri/OpenTopoMap:

• public/roles.js (~591–606): window.TILE_DARK / window.TILE_LIGHT are CARTO URLs, and getTileUrl() falls back to them. This is used by the node-detail map, among others.
• public/customize-v2.js (~1838, ~2047): the customizer preview maps hard-code light_all.
• public/live.js (~1550): the attribution fallback assumes CARTO.

Proposal

• Make every map, including node detail, the customizer previews and the attribution text, take its URL from the configured dark/light provider (map-tile-providers.js / MC_get*TileProvider).
• Use a non-CARTO provider as the default fallback, or keep CARTO only when a key is configured.

Acceptance

• With a non-CARTO provider configured, no request goes to basemaps.cartocdn.com from any page. Check this in a browser by listing the network requests.
• Tests cover getTileUrl() for each provider, and the fallback.

Supersedes #13. That PR added a CARTO API key path instead and is now far behind master.