Fix: read Mapbox token from HF Spaces secret mount

Dockerfile

@@ -3,15 +3,14 @@ FROM node:20-alpine AS builder
 
 WORKDIR /app
 
-# Mapbox token passed as build arg (set in HF Spaces secrets)
-ARG VITE_MAPBOX_TOKEN
-ENV VITE_MAPBOX_TOKEN=$VITE_MAPBOX_TOKEN
-
 COPY package*.json ./
 RUN npm ci
 
 COPY . .
-RUN npm run build
+
+# Read Mapbox token from HF Spaces secret and build
+RUN --mount=type=secret,id=VITE_MAPBOX_TOKEN,mode=0444,required=true \
+    VITE_MAPBOX_TOKEN=$(cat /run/secrets/VITE_MAPBOX_TOKEN) npm run build
 
 # Production stage
 FROM nginx:alpine