fix(map): complete live Cesium provider path

tests/test_map_api.py

@@ -250,6 +250,41 @@ def test_cache_rejects_credentials_non_https_and_non_loopback_clients() -> None:
     assert not requests
 
 
+def test_cache_accepts_only_the_public_bing_gateway_key_marker() -> None:
+    service, requests = _service(
+        lambda request: httpx.Response(
+            200,
+            headers={"content-type": "application/json"},
+            content=b"{}",
+        )
+    )
+
+    accepted = asyncio.run(
+        service.proxy_cache(
+            _request("/api/v1/map/gateway/cache"),
+            target_url=(
+                "https://dev.virtualearth.net/REST/v1/Imagery/Metadata/Aerial"
+                "?key=nodedc-gateway"
+            ),
+        )
+    )
+
+    assert isinstance(accepted, StreamingResponse)
+    assert requests[0].url.params["url"].endswith("key=nodedc-gateway")
+
+    with pytest.raises(HTTPException) as exc_info:
+        asyncio.run(
+            service.proxy_cache(
+                _request("/api/v1/map/gateway/cache"),
+                target_url=(
+                    "https://dev.virtualearth.net/REST/v1/Imagery/Metadata/Aerial"
+                    "?key=browser-secret"
+                ),
+            )
+        )
+    assert exc_info.value.status_code == 422
+
+
 def test_asset_route_is_a_fixed_allowlist() -> None:
     service, requests = _service(
         lambda request: httpx.Response(