Narrow scope to radar, and put the app on a real OpenStreetMap base map

Drops forecasts, lightning, the home-screen widget and advertising. What
remains is radar on a map, the official ARPA alert bulletin, and rain
notifications.

The base map is now OpenFreeMap's Positron style: real OpenStreetMap vector
tiles with no API key, no registration, no request limits and commercial use
permitted. Every other free tier — MapTiler, Stadia, Jawg, Thunderforest —
needs a key, which is a secret to manage, a quota to outgrow and a signup to
complete before anyone can build the project, and the map is the one thing the
app cannot work without. Positron rather than Liberty or Bright because the
radar overlay has to be the loudest thing on screen, and a desaturated grey
base is built to sit under data.

Its style JSON carries no `attribution` field, so MapLibre displays no credits
by itself. The app renders them from the region config instead: the two
mandatory credits, OpenStreetMap and OpenMapTiles, go in the always-visible
bar, and OpenFreeMap's own credit — optional by their terms — is listed on the
Sources screen with the rest. The bundled offline style is still reachable with
MAP_STYLE_URL=offline, and still claims no base map attribution, because
crediting OpenStreetMap while showing it would be a false claim.

Radar-DPC stays the source. ARPA Piemonte's own radar remains a disabled stub
for two reasons that belong to the project owner, not to the code: the
real-time access link is only issued by email, and the open-data page states
the data is "gratuiti" and nothing else. Free of charge is not a licence, and
rendering those volumes into frames served from a CDN is redistribution. Both
questions go in the same email. An earlier draft of the docs recorded ARPA
radar as CC BY 4.0; the source page does not support that, so the claim is
removed rather than carried forward.

The documentation is updated throughout rather than annotated: CLAUDE.md gains
an explicit scope boundary, data-sources drops MET Norway and ISTAT and gains
the base map, licenses records that free of charge is not a licence, privacy
loses the whole advertising section, and the roadmap is renumbered so the
backend worker is next — until it exists, DpcRadarSource has nothing to read.

licenses.md keeps Open-Meteo and Blitzortung listed as excluded even though the
features that would have used them are gone: both are non-commercial-only, ads
are a plausible future, and neither should be adopted on the grounds that there
are none today.

Verified: analyze clean, 130 tests passing, and on the emulator the radar
overlay sits correctly over Piedmont on real OSM tiles with Turin, Milan and
Genoa labelled, the age reads "Aggiornato 4 minuti fa", and the Sources screen
lists all five credits with their licences.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Nuvolari/docs/data-sources.md

@@ -3,7 +3,7 @@
 Every endpoint below was verified on 2026-09-10. Anything not verified is marked
 **TO VERIFY** and must not be relied on until checked.
 
-## 1. Radar — Radar-DPC (default for the MVP)
+## 1. Radar — Radar-DPC (the active source)
 
 Public platform of the Italian Dipartimento della Protezione Civile.
 
@@ -114,30 +114,36 @@ Docs: <https://dpc-radar.readthedocs.io/it/latest/>
 
 ## 2. Radar — ARPA Piemonte (future adapter, disabled)
 
-C-band polarimetric radars at Bric della Croce and Monte Settepani, HDF5 ODIM every
-5 minutes. Access requires authorization requested at `info.meteo@arpa.piemonte.it`.
+C-band polarimetric radars at Bric della Croce and Monte Settepani, scanning every
+5 minutes. Real-time volumes of reflectivity, Doppler velocity and differential
+reflectivity are published in **OPERA HDF5 (ODIM)** format, covering the last hour.
 
-License CC BY 4.0, attribution "Fonte: Arpa Piemonte - www.arpa.piemonte.it".
+Listed as open data at <https://www.arpa.piemonte.it/dato/open-data>, described there as
+constantly updated, machine-readable and free of charge.
 
-`ArpaRadarSource` exists as a **disabled stub**. No request for authorization has been
-sent and none will be sent without an explicit instruction from the project owner.
+**Two things block adoption, and both belong to the project owner, not to the code:**
 
-## 3. Forecast — MET Norway
+1. **The access link is not public.** The page states that to obtain the real-time link
+   for radar and radiosonde data *"è necessario inviare una e-mail all'indirizzo
+   info.meteo@arpa.piemonte.it"*. There is no documented endpoint to call without it.
+2. **No licence is stated.** The page says the data is *gratuiti* — free of charge — and
+   nothing more. Free of charge is not a licence. Rendering these volumes into PNG frames
+   and republishing them through a CDN to app users is redistribution, and without stated
+   terms there is no permission to point at. The email should ask for the reuse terms as
+   well as the link.
 
-- `https://api.met.no/weatherapi/locationforecast/2.0/compact?lat=<lat>&lon=<lon>`
-- A **descriptive, identifying `User-Agent` is mandatory** (application name plus a
-  contact address). Requests with a generic or missing User-Agent are blocked.
-- Honour `Expires` and use `If-Modified-Since`; do not re-request before expiry.
-- License CC BY 4.0, **commercial use allowed**.
+Until both are answered, `ArpaRadarSource` stays a stub whose every method throws. It is
+named by the region config as unavailable so the seam is visible, not because it is
+nearly ready.
 
-### Fallback — ItaliaMeteo ICON-2I via MeteoHub
+> Earlier drafts of this document recorded ARPA radar as CC BY 4.0. The open-data page
+> does not support that, so the claim has been removed rather than carried forward.
 
-License CC BY 4.0, attribution "ItaliaMeteo-ARPAE". Endpoint details **TO VERIFY**
-before the adapter is enabled.
+## 3. Forecast — out of scope
 
-### Explicitly excluded
-
-**Open-Meteo free tier** — non-commercial only, and this app carries ads.
+The app shows radar, not forecasts. No forecast provider is integrated, and MET Norway,
+ItaliaMeteo ICON-2I and Open-Meteo are all out of scope. See CLAUDE.md for the current
+scope boundary.
 
 ## 4. Alerts — ARPA Piemonte XML-CAP
 
@@ -221,21 +227,42 @@ come from the ARPA zone documentation.
 A captured copy of the live feed is kept as a test fixture so the parser is verified
 against the real document rather than a hand-written approximation.
 
-## 5. Municipalities — ISTAT
+## 5. Base map — OpenFreeMap
 
-Piedmont municipality list to bundle in assets. Source **TO VERIFY** — the ISTAT
-"Codici statistici delle unità amministrative territoriali" dataset is the intended
-origin but the stable download URL has not been confirmed yet.
+OpenStreetMap vector tiles served by **OpenFreeMap** (<https://openfreemap.org>).
 
-## 6. Base map — OpenStreetMap
+- Style in use: `https://tiles.openfreemap.org/styles/positron`
+- Tiles: `https://tiles.openfreemap.org/planet`
+- Glyphs: `https://tiles.openfreemap.org/fonts/{fontstack}/{range}.pbf`
 
-Vector tiles via MapTiler (API key required, supplied through `MAP_STYLE_URL`) or
-self-hosted PMTiles. **OSM/ODbL attribution must stay visible on the map at all times.**
+**No API key, no registration, no request limits, commercial use permitted.** That is
+what makes it the right starting point: every other free tier — MapTiler, Stadia, Jawg,
+Thunderforest — requires a key, which means a secret to manage and a quota to outgrow.
 
-Until a key is configured the app falls back to a minimal local style so that
-development and tests run fully offline.
+Positron rather than Liberty or Bright: a radar overlay has to be the loudest thing on
+screen, and Positron is a desaturated grey base designed to sit under data. On Liberty
+the precipitation colours compete with road casings and landuse fills.
 
-## 7. Lightning — excluded
+### Mandatory credits
 
-**Blitzortung must not be used**: its data prohibits commercial use. If a lightning
-layer is ever added it will come from the DPC `LTG` product instead.
+| Credit | Required? |
+|---|---|
+| `© OpenStreetMap contributors` (ODbL) | **yes** |
+| `© OpenMapTiles` | **yes** |
+| `OpenFreeMap` | optional, and appreciated |
+
+The style JSON carries **no `attribution` field**, so MapLibre will not display these on
+its own. The app renders them itself from the region config: the two mandatory credits
+go in the always-visible attribution bar, and all three are listed on the Sources screen.
+
+### When there is no network
+
+With `MAP_STYLE_URL=offline` the app generates a self-contained style from the region
+bounding box — flat background plus the extent outline, no network sources at all. It is
+deliberately plain so it is never mistaken for a finished map, and it is what the widget
+tests run against.
+
+## 6. Lightning — out of scope
+
+Not part of the app. If it is ever revisited: **Blitzortung prohibits commercial use**,
+and the DPC `LTG` product is the source to reach for instead.