Narrow scope to radar, and put the app on a real OpenStreetMap base map

Drops forecasts, lightning, the home-screen widget and advertising. What
remains is radar on a map, the official ARPA alert bulletin, and rain
notifications.

The base map is now OpenFreeMap's Positron style: real OpenStreetMap vector
tiles with no API key, no registration, no request limits and commercial use
permitted. Every other free tier — MapTiler, Stadia, Jawg, Thunderforest —
needs a key, which is a secret to manage, a quota to outgrow and a signup to
complete before anyone can build the project, and the map is the one thing the
app cannot work without. Positron rather than Liberty or Bright because the
radar overlay has to be the loudest thing on screen, and a desaturated grey
base is built to sit under data.

Its style JSON carries no `attribution` field, so MapLibre displays no credits
by itself. The app renders them from the region config instead: the two
mandatory credits, OpenStreetMap and OpenMapTiles, go in the always-visible
bar, and OpenFreeMap's own credit — optional by their terms — is listed on the
Sources screen with the rest. The bundled offline style is still reachable with
MAP_STYLE_URL=offline, and still claims no base map attribution, because
crediting OpenStreetMap while showing it would be a false claim.

Radar-DPC stays the source. ARPA Piemonte's own radar remains a disabled stub
for two reasons that belong to the project owner, not to the code: the
real-time access link is only issued by email, and the open-data page states
the data is "gratuiti" and nothing else. Free of charge is not a licence, and
rendering those volumes into frames served from a CDN is redistribution. Both
questions go in the same email. An earlier draft of the docs recorded ARPA
radar as CC BY 4.0; the source page does not support that, so the claim is
removed rather than carried forward.

The documentation is updated throughout rather than annotated: CLAUDE.md gains
an explicit scope boundary, data-sources drops MET Norway and ISTAT and gains
the base map, licenses records that free of charge is not a licence, privacy
loses the whole advertising section, and the roadmap is renumbered so the
backend worker is next — until it exists, DpcRadarSource has nothing to read.

licenses.md keeps Open-Meteo and Blitzortung listed as excluded even though the
features that would have used them are gone: both are non-commercial-only, ads
are a plausible future, and neither should be adopted on the grounds that there
are none today.

Verified: analyze clean, 130 tests passing, and on the emulator the radar
overlay sits correctly over Piedmont on real OSM tiles with Turin, Milan and
Genoa labelled, the age reads "Aggiornato 4 minuti fa", and the Sources screen
lists all five credits with their licences.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Nuvolari/docs/architecture.md

@@ -14,7 +14,7 @@
                                      cells.json
                    │
                    ▼
-              Flutter app  ◄──  api.met.no  (direct, identifying User-Agent)
+            Flutter app  ──►  OpenFreeMap  (base map tiles)
 ```
 
 **The app never talks to DPC or ARPA directly.** Both would be rate-limited by
@@ -22,8 +22,9 @@ thousands of clients, DPC presigned URLs expire in minutes, and the rasters are
 whole-Italy GeoTIFFs that a phone should not decode. The worker is the only client of
 those services, and it fans out through a CDN.
 
-MET Norway is the exception: it is designed for per-client access, its license permits
-it, and forecasts are per-location so a shared cache would not help.
+The base map is the one exception, and it is not our data: OpenFreeMap serves public
+OpenStreetMap vector tiles with no key and no limits, and proxying them through our own
+infrastructure would add cost and latency for nothing.
 
 ## Monorepo
 
@@ -47,10 +48,9 @@ lib/
 │   └─ l10n/      localisation plumbing
 ├─ data/        one folder per domain, each exposing an interface
 │   ├─ radar/     RadarSource + Dpc/Arpa/Mock implementations + models
-│   ├─ forecast/  ForecastSource + MetNo/IconIt2 implementations
 │   └─ alerts/    AlertSource + ArpaCap implementation
 ├─ features/    one folder per screen or coherent UI area
-│   ├─ map/ timeline/ forecast/ alerts/ sources/ consent/ ads/
+│   ├─ map/ timeline/ alerts/ sources/
 └─ l10n/        app_it.arb (template)
 ```
 
@@ -75,8 +75,7 @@ Three implementations:
 | `ArpaRadarSource` | **disabled stub** | Placeholder until ARPA authorization exists. Throws if constructed while its feature flag is off. |
 
 The active source is resolved from the region config plus a runtime flag, so switching
-sources is configuration, never a code change. `ForecastSource` and `AlertSource`
-follow the same pattern.
+sources is configuration, never a code change. `AlertSource` follows the same pattern.
 
 Because `MockRadarSource` is a first-class implementation rather than test scaffolding,
 the whole UI — timeline, scrubbing, prefetch, cache eviction, degraded states — is
@@ -116,7 +115,9 @@ can be offline. The rules:
 - Manifest unreachable → keep the last good manifest from cache, show a
   "dati non disponibili" banner with the age of the newest frame.
 - Individual frame missing → hold the previous frame in the timeline; never a blank map.
-- No frames at all → the map and the forecast still work; only the radar layer is empty.
+- No frames at all → the base map and the alerts still work; only the radar layer is empty.
+- Base map tiles unreachable → MapLibre draws what it has; the radar overlay is
+  positioned geographically, not relative to the tiles, so it stays correct.
 - Animation stops when the app leaves the foreground (`AppLifecycleState`) so a
   backgrounded app never burns battery prefetching.
 
@@ -125,7 +126,8 @@ worse than no radar.
 
 ## Privacy by construction
 
-No user location ever reaches a server. Forecast requests go from the device straight
-to MET Norway. Rain notifications work by the device subscribing to FCM topics named
-after geographic cells — the subscription happens on the device, so the backend holds
-no user records at all.
+No user location ever reaches a server. Rain notifications work by the device
+subscribing to FCM topics named after geographic cells — the subscription happens on the
+device, so the backend holds no user records at all. With no advertising and no forecast
+provider, nothing about the user leaves the device except the area the map is looking at,
+which is inherent to any hosted base map.