Fix broken basemaps and add Carto/Stadia API key support

Half the basemaps we offer don't work:

• All six Carto styles are watermarked without an API key, including Voyager, our default.
• The six Stamen styles return 401 on any real domain.
• Esri DeLorme is retired (404).

Because Voyager is the default, most existing sites are showing a watermarked map and probably don't know it. Fixing this means those sites will visibly change to OpenStreetMap, their setting is preserved, so adding a Carto key restores it.

The Stamen problem is easy to miss: those styles moved to Stadia hosting, and Stadia now requires an API key or a registered domain for anything but localhost. They render normally on localhost, so a developer testing locally sees nothing wrong.

Closes #76. Takes over part of #80.

What needs doing:

• Change the default basemap to OpenStreetMap.
• Remove Esri DeLorme and migrate sites using it.
• Update leaflet-providers to v4.0.0, which adds Carto's API key support.
• Add Carto and Stadia API key fields, alongside the existing Mapbox one.
• Tell admins in the config form when their basemap needs a key, and substitute the default where we can do that safely.
• Add a contrast suggestion to the Base Map setting (from #80).