Track what was actually built, and flag when it's stale

The .pmtiles files themselves carry no record of what upstream
snapshot they came from — only a local mtime. Each successful build
now writes a small sidecar (offline.pmtiles.meta.json: the Protomaps
build date used; terrain.pmtiles.meta.json: the Mapterhorn source
names/md5sums) recording that, surfaced in the panel next to the
existing size/updated line.

New GET .../check-update routes compare the recorded build against
the live upstream index/manifest — true/false/null, null meaning
"don't know" (no local build yet, or the check itself failed) rather
than a false "no". Kept separate from the plain status endpoints
(which map.js's own topbar dot hits on every page load) since this
one reaches an external service; only called once when the Offline
data panel is actually opened.

Also: flag emoji next to each country in the picker (derived from the
ISO code via Unicode regional indicators, no image assets needed).

test/test_app.rb

@@ -387,6 +387,11 @@ class AppTest < Minitest::Test
     assert_equal({ "state" => "idle" }, json_body(request.get("/api/terrain-tiles/build-status")))
   end
 
+  def test_check_update_is_null_before_any_build
+    assert_nil json_body(request.get("/api/offline-tiles/check-update"))["update_available"]
+    assert_nil json_body(request.get("/api/terrain-tiles/check-update"))["update_available"]
+  end
+
   def test_offline_tiles_build_is_409_with_no_selection
     response = request.post("/api/offline-tiles/build", **logged_in_env)
     assert_equal 409, response.status