[CHORE]: Prepare for CARTO basemap API key enforcement #8141

Description

Prepare plotly.js for CARTO enforcing its basemap API key on vector tiles. Find out when enforcement starts, decide how Plotly handles it, and document the outcome for users. Today CARTO enforces the key only for raster tiles, which Plotly does not use.

Why should this change be made?

CARTO's docs say an API key is required for all CARTO basemaps. Plotly's carto-* styles and the legacy basic, streets, outdoors, light and dark styles load keyless vector styles from basemaps.cartocdn.com/gl/. If CARTO enforces the key for vector tiles, all of these styles stop loading for every user. Plotly has no way to pass a key. A shared key in the bundle would count against one quota and break CARTO's terms.

Scope

• Ask CARTO or the maintainers when vector enforcement starts
• Decide what Plotly does when it starts: document the ?key= workaround through map.style, or choose a default basemap that needs no key
• Add a note under layout.map.style that CARTO styles fall under CARTO's terms and may need an API key
• Stop the tests and baselines from using the live CARTO style, so they do not break when CARTO changes its data or its key rules (see the baseline breakage after CARTO's 2026-10-21 move to carto.streets/v2)

Notes

• CARTO docs: https://github.com/CartoDB/basemap-styles#readme
• Free tiers: 5M tile requests a month for non-commercial use, 1M for commercial use
• Terms: https://carto.com/legal/basemap-terms/
• Observed on 2026-10-22: a keyless raster tile returns an "API KEY REQUIRED" watermark. Keyless vector style, tile and font requests return 200 with real data, and so do requests with a made-up key.