Tianditu tiles return 403 because the Referer is not whitelisted

• All requests to `t{0-7}.tianditu.gov.cn/vec_w/wmts` return `403 Forbidden` with a body containing `Invalid referer`
• The identical URL opened directly in the address bar returns the JPEG image
• Opening the page over `file://` or from `localhost:5173` fails in the same way

1. Read the actual `Referer` request header in dev tools
2. Compare it character by character with the whitelisted domains, including port and `www`
3. Test with `curl -H "Referer: https://example.com/"` against the full WMTS URL
4. Check for a proxy or hosts rewrite that alters the Referer
5. Test without a Referer header to see that the whitelist check is skipped

Add the dev origin to the key's whitelist, or proxy same-origin during development (`server.proxy['/tdt']` with `changeOrigin: true` and a path rewrite) and request `/tdt/vec_w/wmts?...&tk=...`; in production register the real domain instead of proxying.

<html>
<head><title>403 Forbidden</title></head>
<body><h1>403 Forbidden</h1><p>Invalid referer</p></body>
</html>

# 带合法 Referer，应返回 200
curl -I -H "Referer: https://example.com/" ^
  "https://t0.tianditu.gov.cn/vec_w/wmts?SERVICE=WMTS&REQUEST=GetTile&VERSION=1.0.0&LAYER=vec&STYLE=default&TILEMATRIXSET=w&FORMAT=tiles&TILEMATRIX=10&TILEROW=392&TILECOL=843&tk=你的key"

# 不带 Referer 也可能 200，容易被误判为 Key 没问题
curl -I "https://t0.tianditu.gov.cn/vec_w/wmts?..."

• Concluding the key is broken because the URL works when pasted; address-bar requests send no Referer and bypass the check
• Shipping a production proxy that hides the real domain, which works but moves all tile traffic onto your server and breaks the key binding