[bubulux]

Closes #281

What changed

• Studio: one shared tile layer, mapTiles.ts osmTiles(), for the three maps (shots map, Locations, Position stage). It sets referrerPolicy: "strict-origin-when-cross-origin", so tile requests carry the page's origin. The page-wide Referrer-Policy: same-origin stays as it is.
• Phone: the map WebView's baseUrl is the instance's own origin (API_URL) instead of https://openclapper.local/. The tile layer sets the same policy explicitly.
• Docs: infrastructure.md (the OpenStreetMap row).

Decisions

• Only the tile requests send a Referer, and only the origin: no paths or shot ids leave the page.
• No tile provider setting or proxy yet. The issue keeps both as the next step if blocks continue.

Checked

• make check green.
• Headless Chrome, local Studio: the Position stage's 15 tiles carry referrerPolicy=strict-origin-when-cross-origin and load.

Not verified

• The block itself doesn't reproduce from this machine: tiles load here with or without a Referer. Whether this lifts it for the owner's browser and the phone shows only on staging.
• The phone map.

🤖 Generated with Claude Code