Add the region map, permanent attribution and the Sources screen

Puts a MapLibre map on screen framed on the region, with the credit
obligations that come with showing third-party data satisfied structurally
rather than by remembering to add a label.

The base map style comes from MAP_STYLE_URL, and with no key configured the
app generates a fallback style from the region's own bounding box: a flat
background and the extent outline, no network sources at all. That keeps a
fresh clone runnable offline without pulling in a boundary dataset that would
carry its own licence, and it deliberately looks like a placeholder so it is
not mistaken for a finished map.

Attribution is driven by what is actually rendered. The bar lists the credits
for the active sources only, because crediting OpenStreetMap while showing the
fallback style would be a false attribution, and it says plainly when no base
map is configured. It sits below the map rather than floating over it so no
map control or gesture overlay can occlude a credit that the ODbL and CC BY-SA
terms require to be visible.

The Sources screen leads with the independence disclaimer, before the sources
it qualifies, so a reader who stops after the first screenful has still seen
it. Sources with no stated licence — ARPA publishes none for the alert
bulletin — say so explicitly rather than being shown bare or given an invented
one. A separate note explains that the rendered radar frames inherit CC BY-SA
from the DPC source data.

Also declares the INTERNET permission in the main manifest: Flutter injects it
into the debug and profile manifests only, so a release build would otherwise
fail every request on device.

Verified: analyze clean, 66 tests passing, appbundle builds with the native
MapLibre plugin. Not verified visually — this machine has no Android device or
emulator image, so nobody has watched the map render.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Nuvolari/docs/roadmap.md

@@ -21,7 +21,7 @@ platform 36, build-tools 36.0.0, platform-tools and all licences accepted, and
 `JAVA_HOME` pointing at the JDK 21 a previous Visual Studio install had already left
 on the machine.
 
-## M1 — Scaffold, Italian l10n, region config, CI 🔨
+## M1 — Scaffold, Italian l10n, region config, CI ✅
 
 `flutter create` with applicationId `it.nuvolari.app`; `flutter_localizations` + `intl`
 with `app_it.arb` as template and no hardcoded UI strings; `RegionConfig` loaded from
@@ -31,10 +31,14 @@ with `app_it.arb` as template and no hardcoded UI strings; `RegionConfig` loaded
 **Accepts when:** `flutter analyze` reports 0 issues, `flutter test` passes,
 `flutter build appbundle --debug` succeeds.
 
+**Done.** All four stages green; the AAB carries applicationId `it.nuvolari.app`,
+minSdk 24, targetSdk 36. 50 tests, including assertions against the shipped Piemonte
+asset and a captured copy of the live ARPA CAP feed.
+
 > The Gitea instance may have no Actions runner. The workflow file is written to be
 > GitHub-Actions compatible, but `tool/verify.ps1` is the verification that must pass.
 
-## M2 — Map, attribution, Sources screen
+## M2 — Map, attribution, Sources screen ✅
 
 MapLibre with the style from `MAP_STYLE_URL`, falling back to a local minimal style.
 Permanent OSM/ODbL attribution. Sources / Licenses / Disclaimer screen covering
@@ -44,7 +48,18 @@ disclaimer.
 **Accepts when:** the map opens centred on Piedmont, attribution is visible at all
 times, and the Sources screen is reachable and complete.
 
-## M3 — Animation and timeline
+**Done**, with one gap. The fallback style is generated from the region bounding box
+rather than loaded from an asset, so it needs no third-party boundary dataset and no
+network. The attribution bar lists only the sources actually rendered — crediting
+OpenStreetMap while showing the fallback would be a false attribution — and sits below
+the map rather than floating over it so no map control can occlude it.
+
+**Not visually verified.** This machine has no Android device and no emulator image, so
+the map has been proven to build and its logic unit-tested, but nobody has watched it
+render. Connect a phone over USB or install an emulator system image before trusting
+the visual result.
+
+## M3 — Animation and timeline 🔨
 
 `RadarSource` with `MockRadarSource` (synthetic frames in assets) and `DpcRadarSource`.
 Timeline scrubber, play/pause, adjacent-frame prefetch, `FrameCache` LRU, animation