fix(places): unblock MapLibre worker and fix false-positive basemap probe

Two issues kept the Photos → Places map blank once the SPA could boot:

- CSP `worker-src 'self'` blocked MapLibre GL, which spawns its web worker
  from a blob: URL, so the map never constructed. Allow `worker-src
  'self' blob:` ('self' still covers same-origin workers like delta-upload).

- `checkBasemap()` trusted `res.ok`, but the SPA fallback serves index.html
  (HTTP 200, text/html) for any missing path — so a missing basemap.pmtiles
  read as "present", and pmtiles.js then choked on HTML ("Wrong magic
  number for PMTiles archive"). Reject text/html responses so an absent
  basemap falls back cleanly to the themed blank style.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/lib/components/PlacesMap.svelte

@@ -51,7 +51,12 @@
 		if (hasBasemap !== null) return hasBasemap;
 		try {
 			const res = await fetch(BASEMAP_URL, { headers: { Range: 'bytes=0-0' } });
-			hasBasemap = res.ok; // 200/206 = present, 404 = absent
+			// The SPA fallback serves index.html (HTTP 200, text/html) for any
+			// missing path, so `res.ok` alone can't distinguish "basemap present"
+			// from "absent". A real .pmtiles is binary (octet-stream); the shell
+			// is HTML — treat an HTML body as "no basemap" and fall back cleanly.
+			const type = res.headers.get('Content-Type') ?? '';
+			hasBasemap = res.ok && !type.toLowerCase().includes('text/html');
 		} catch {
 			hasBasemap = false;
 		}