cleanup: drop coord backfill, drop transit overlay, block PM autofill

- Remove the admin "Koordinaten nachladen" button, /actions/backfill-coords
  endpoint, geocode.py, googlemaps dep, GMAPS_API_KEY plumbing in the web
  service, and the map diagnostic line. Going-forward geocoding happens in
  alert on scrape; upsert_flat backfill on re-submit remains for edge cases
- Remove the OpenRailwayMap transit overlay (visually noisy); keep CartoDB
  Voyager as the sole basemap
- Profile + notifications forms get autocomplete="off" + data-lpignore +
  data-1p-ignore at form and field level to keep password managers from
  popping open on /einstellungen; immomio_password uses autocomplete=new-password

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/app.py

@@ -33,7 +33,6 @@ except Exception:
     BERLIN_TZ = timezone.utc
 
 import db
-import geocode
 import notifications
 import retention
 from apply_client import ApplyClient, _row_to_profile
@@ -135,9 +134,7 @@ async def security_headers(request: Request, call_next):
         "script-src 'self' https://cdn.tailwindcss.com https://unpkg.com; "
         "style-src 'self' https://cdn.tailwindcss.com https://unpkg.com 'unsafe-inline'; "
         "img-src 'self' data: "
-        "https://*.tile.openstreetmap.org https://tile.openstreetmap.org "
         "https://*.basemaps.cartocdn.com https://basemaps.cartocdn.com "
-        "https://*.tiles.openrailwaymap.org https://tiles.openrailwaymap.org "
         "https://unpkg.com; "
         "connect-src 'self'; frame-ancestors 'none';"
     )
@@ -406,12 +403,6 @@ def _wohnungen_context(user) -> dict:
         flats_view.append({"row": f, "last": last})
 
     rejected_view = db.rejected_flats(uid)
-    matched_count = len(flats_view)
-    matched_with_coords = sum(
-        1 for item in flats_view
-        if item["row"]["lat"] is not None and item["row"]["lng"] is not None
-    )
-    matched_without_coords = matched_count - matched_with_coords
 
     allowed, reason = _manual_apply_allowed()
     alert_label, alert_chip = _alert_status(notif_row)
@@ -433,10 +424,6 @@ def _wohnungen_context(user) -> dict:
         "flats": flats_view,
         "rejected_flats": rejected_view,
         "map_points": map_points,
-        "map_matched_total": matched_count,
-        "map_matched_with_coords": matched_with_coords,
-        "map_matched_without_coords": matched_without_coords,
-        "gmaps_available": bool(geocode._get_client() is not None),
         "has_filters": _has_filters(filters_row),
         "alert_label": alert_label,
         "alert_chip": alert_chip,
@@ -562,31 +549,6 @@ async def action_reject(
     return _wohnungen_partial_or_redirect(request, user)
 
 
-@app.post("/actions/backfill-coords")
-async def action_backfill_coords(
-    request: Request,
-    csrf: str = Form(...),
-    admin=Depends(require_admin),
-):
-    require_csrf(admin["id"], csrf)
-    rows = db.flats_missing_coords(limit=500)
-    total = len(rows)
-    resolved = 0
-    skipped = 0
-    for row in rows:
-        coords = geocode.geocode(row["address"])
-        if coords is None:
-            skipped += 1
-            continue
-        db.set_flat_coords(row["id"], coords[0], coords[1])
-        resolved += 1
-    summary = f"{resolved}/{total} geocoded, {skipped} übersprungen"
-    logger.info("coord backfill: %s", summary)
-    db.log_audit(admin["username"], "coords.backfill", summary,
-                 user_id=admin["id"], ip=client_ip(request))
-    return _wohnungen_partial_or_redirect(request, admin)
-
-
 @app.post("/actions/unreject")
 async def action_unreject(
     request: Request,