feat(phases 2-7): implement full GPS-denied navigation pipeline

Phase 2 — Visual Odometry:
  - ORBVisualOdometry (dev/CI), CuVSLAMVisualOdometry (Jetson)
  - TRTInferenceEngine (TensorRT FP16, conditional import)
  - create_vo_backend() factory

Phase 3 — Satellite Matching + GPR:
  - SatelliteDataManager: local z/x/y tiles, ESKF ±3σ tile selection
  - GSD normalization (SAT-03), RANSAC inlier-ratio confidence (SAT-04)
  - GlobalPlaceRecognition: Faiss index + numpy fallback

Phase 4 — MAVLink I/O:
  - MAVLinkBridge: GPS_INPUT 15+ fields, IMU callback, 1Hz telemetry
  - 3-consecutive-failure reloc request
  - MockMAVConnection for CI

Phase 5 — Pipeline Wiring:
  - ESKF wired into process_frame: VO update → satellite update
  - CoordinateTransformer + SatelliteDataManager via DI
  - MAVLink state push per frame (PIPE-07)
  - Real pixel_to_gps via ray-ground projection (PIPE-06)
  - GTSAM ISAM2 update when available (PIPE-03)

Phase 6 — Docker + CI:
  - Multi-stage Dockerfile (python:3.11-slim)
  - docker-compose.yml (dev), docker-compose.sitl.yml (ArduPilot SITL)
  - GitHub Actions: ci.yml (lint+pytest+docker smoke), sitl.yml (nightly)
  - tests/test_sitl_integration.py (8 tests, skip without SITL)

Phase 7 — Accuracy Validation:
  - AccuracyBenchmark + SyntheticTrajectory
  - AC-PERF-1: 80% within 50m ✅
  - AC-PERF-2: 60% within 20m ✅
  - AC-PERF-3: p95 latency < 400ms ✅
  - AC-PERF-4: VO drift 1km < 100m ✅ (actual ~11m)
  - scripts/benchmark_accuracy.py CLI

Tests: 195 passed / 8 skipped

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.sitl.yml

@@ -0,0 +1,120 @@
+# ---------------------------------------------------------------------------
+# GPS-Denied Onboard — ArduPilot SITL Integration Harness
+# ---------------------------------------------------------------------------
+# Runs ArduPlane SITL alongside the gps-denied service on a shared network.
+# GPS_INPUT messages are sent by gps-denied to the SITL FC via MAVLink.
+#
+# Usage:
+#   docker compose -f docker-compose.sitl.yml up --build
+#   docker compose -f docker-compose.sitl.yml run integration-tests
+#   docker compose -f docker-compose.sitl.yml down -v
+#
+# Integration tests (skipped unless ARDUPILOT_SITL_HOST is set):
+#   ARDUPILOT_SITL_HOST=ardupilot-sitl \
+#   docker compose -f docker-compose.sitl.yml run integration-tests
+# ---------------------------------------------------------------------------
+
+version: "3.9"
+
+services:
+
+  # --------------------------------------------------------------------------
+  # ArduPilot SITL — ArduPlane (fixed-wing) simulator
+  # Exposes:
+  #   5762/tcp — MAVLink connection for gps-denied (GPS_INPUT output)
+  #   5763/tcp — MAVLink connection for ground-station / MAVProxy
+  # --------------------------------------------------------------------------
+  ardupilot-sitl:
+    image: ardupilot/ardupilot-dev:latest
+    container_name: ardupilot-sitl
+    command: >
+      bash -c "
+        cd /ardupilot &&
+        Tools/autotest/sim_vehicle.py
+          -v ArduPlane
+          -f plane-elevon
+          --no-rebuild
+          --no-mavproxy
+          --out=tcp:0.0.0.0:5762
+          --out=tcp:0.0.0.0:5763
+          --speedup=1
+          --simin=none
+      "
+    ports:
+      - "5762:5762"
+      - "5763:5763"
+    networks:
+      - sitl_net
+    # SITL needs a few seconds to boot before gps-denied connects
+    healthcheck:
+      test: ["CMD", "nc", "-z", "localhost", "5762"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 30s
+
+  # --------------------------------------------------------------------------
+  # GPS-Denied Onboard service — connects to SITL via TCP MAVLink
+  # --------------------------------------------------------------------------
+  gps-denied:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: gps-denied-onboard:sitl
+    container_name: gps-denied-sitl
+    ports:
+      - "8000:8000"
+    environment:
+      GPS_DENIED_DB_PATH: /data/flights.db
+      GPS_DENIED_TILE_DIR: /data/satellite_tiles
+      GPS_DENIED_LOG_LEVEL: DEBUG
+      # MAVLink: connect to SITL FC on TCP
+      ARDUPILOT_SITL_HOST: ardupilot-sitl
+      ARDUPILOT_SITL_PORT: "5762"
+      MAVLINK_CONNECTION: "tcp:ardupilot-sitl:5762"
+    volumes:
+      - sitl_data:/data
+    depends_on:
+      ardupilot-sitl:
+        condition: service_healthy
+    networks:
+      - sitl_net
+    restart: on-failure
+
+  # --------------------------------------------------------------------------
+  # Integration test runner — runs test_sitl_integration.py against live SITL
+  # --------------------------------------------------------------------------
+  integration-tests:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: builder
+    container_name: sitl-integration-tests
+    entrypoint: >
+      python -m pytest tests/test_sitl_integration.py -v
+        --timeout=60
+        --tb=short
+    environment:
+      ARDUPILOT_SITL_HOST: ardupilot-sitl
+      ARDUPILOT_SITL_PORT: "5762"
+      PYTHONPATH: /app/src
+    volumes:
+      - ./src:/app/src:ro
+      - ./tests:/app/tests:ro
+    depends_on:
+      ardupilot-sitl:
+        condition: service_healthy
+      gps-denied:
+        condition: service_healthy
+    networks:
+      - sitl_net
+    profiles:
+      - test
+
+volumes:
+  sitl_data:
+    driver: local
+
+networks:
+  sitl_net:
+    driver: bridge