origin: ['*'] in config/cors.ts never matches a real Origin header,
since @adonisjs/cors only treats '*' as a wildcard when it's the bare
string, not inside an array. So no Access-Control-Allow-Origin is ever
sent, on any route, blocking any other app from reading NOMAD's map
tiles cross-origin.
Add a middleware scoped to the four map asset path prefixes instead of
widening the global config, which would also expose the write API since
credentials: true is already set there. Registered before @adonisjs/cors
so it can answer OPTIONS preflights on map paths itself; the built-in
middleware ends any preflight it can't match an origin for before this
one would otherwise run.
2703057f37