Closes the "no map view" gap for origin zones: the polygon was stored as
coordinates and shown as raw JSON, so the shape could not be checked by eye.
- vendor Leaflet 1.9.4 into apps/core/static/vendor/leaflet. Self-hosted rather
than pulled from a CDN, because this renders supplier-location data.
PROVENANCE.md records the version, source, licence (BSD-2-Clause), checksums
and upgrade steps; the checksums match the SRI hashes Leaflet publishes
- OriginZoneAdmin gains an "Area on a map" read-only row and its Media assets;
apps/compliance/static/js/ixg_zone_map.js draws the polygon from the stored
geometry, passed through a data attribute rather than injected into a script
- the tile source is a setting (LEAFLET_TILE_URL), so moving to self-hosted
tiles is a config change, not a code change
Deliberately display only: it draws what is stored. It does not validate the
geometry, and it does not verify the zone - both remain open work, and the page
says so where the map appears.
Tests cover the drawn map, a zone with no coordinates, and the add page.
