feat: professionalize network map, align Praxium theme, fix OSM tile policy block

[selectdimensions]

Summary

This branch's prior commit (2fd4397) is a large redesign/professionalization pass — split the monolithic organization-network-map.html into map.css/map.js/network-data.js, added a Praxium design-token stylesheet, hardened the API layer (rate limiting, validation, session handling), added new tests, and refreshed branding throughout.

This PR adds one more commit on top that fixes something the redesign broke:

Tile provider was hitting OSM's own servers directly (policy violation → blocked)

Both light and dark rendering pointed straight at tile.openstreetmap.org. OSM's tile usage policy (osm.wiki/tile_usage_policy) explicitly requires production apps embedded elsewhere (like this one, meant for a Squarespace iframe) to use a third-party provider instead of hotlinking their volunteer-run servers — and the app had in fact been blocked (osm.wiki/blocked), which is what surfaced this.

• Tried CARTO's basemaps as a replacement first — they now require a signed-up API key even on the free tier, which isn't something to add silently.
• Switched to Esri's community Canvas basemaps (World_Light_Gray_Base / World_Dark_Gray_Base) instead: genuinely keyless, no signup, and gives dark mode a real dark basemap instead of a CSS invert() filter faking one over (blocked) OSM tiles.
• Updated the CSP img-src in both the public map page and vercel.json's /admin headers to match the new host.
• Added maxNativeZoom: 16 (Esri's native tile ceiling) with maxZoom: 19 so Leaflet upscales rather than showing blank tiles past that.

Also restored a regression

The initial map view had reverted to a generic [20, 0] world center during the redesign, losing an earlier fix that centers it on the Praxium Foundation's actual location (Vancouver, BC) at zoom 5.

Test plan

• npm run validate (syntax checks + all three test suites) passes unchanged.
• Headless-browser check: real tiles render (not "API key required" placeholders) in both light and dark mode.
• Confirmed zero CSP violations in the browser console after the img-src update.
• Confirmed the map now centers on Praxium's coordinates on load.

Once merged, this will deploy to GitHub Pages via the existing static.yml workflow and be ready to embed in the Squarespace site.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
interactive-map	Ready	Preview	Sep 27, 2026 10:29pm UTC

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved CSP, version-display, initial-view, and /admin header issues remain, along with documentation, token, and preconnect nits.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Allow Esri tiles in the map preview CSP · New
• Remove stale OpenStreetMap preconnect · New

What changed in this PR

Professionalizes the Praxium network map, strengthens API/admin handling, and migrates basemap tiles from OSM to Esri.

Changes:

• Splits the map into modular HTML, CSS, JavaScript, and data assets.
• Adds Praxium branding, responsive UI, validation, security headers, tests, and CI updates.
• Updates Electron tooling, deployment workflows, documentation, and tile configuration.

File	Reviewed change
vercel.json	Deployment security headers and updated tile CSP.
test/​public-assets.test.js	Public asset and security tests.
test/​network-data.test.js	Data normalization and relationship tests.
test/​api.test.js	API, validation, and concurrency tests.
README.md	Architecture and workflow documentation.
praxium-tokens-v2.css	Praxium design tokens.
praxium-contrast-comparison.html	Contrast decision documentation.
package.json	Tooling, scripts, dependencies, and Node requirements.
organization-network-map.html	Public map structure and CSP.
network-data.js	Shared data normalization utilities.
map.js	Map rendering, filtering, themes, and Esri tiles.
map.css	Responsive map styling.
electron/​README.md	Electron setup and icon documentation.
electron/​main.js	Desktop window and IPC hardening.
electron/​icons/​icon.svg	Branded vector application icon.
docs/​PROFESSIONALIZATION_ROADMAP.md	Architecture and operational roadmap.
api/​publish.js	Field validation and relationship persistence.
api/​geocode.js	Address and coordinate validation.
api/​auth.js	Failed-login rate limiting.
api/​_lib/​session.js	Session-secret validation.
api/​_lib/​rateLimit.js	Failure tracking and reset behavior.
api/​_lib/​http.js	Secure response headers.
api/​_lib/​githubGist.js	API versioning and immutable revisions.
admin/​index.html	Admin login security metadata.
admin/​dashboard.html	Admin fields, CSP, and Leaflet integrity metadata.
admin/​admin.js	Esri preview tiles and expanded fields.
admin-editor/​README.md	Editor capability documentation.
admin-editor/​index.html	Expanded organization fields and limits.
admin-editor/​app.js	Relationship and field handling.
.nvmrc	Node major version.
.gitignore	Local artifact exclusions.
.github/​workflows/​static.yml	Modular public asset deployment.
.github/​workflows/​ci.yml	Dependency, syntax, and test validation.
.github/​workflows/​build-release.yml	Node 22 release builds.
.github/​dependabot.yml	Dependency update automation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.