[AZ-701] HTTP replay API service (FastAPI + magic-byte upload validation)

New replay_api component: FastAPI service wrapping the offline
gps-denied-replay pipeline. POST tlog+video (multipart) → either
sync 200 with result/map/report URLs, or async 202 + job id with
/jobs/{id} polling. Magic-byte validation, bearer auth, in-memory
JobRegistry with concurrency + queue caps (429 on overflow).

Helper accuracy_report.py promoted from tests/ to src/ because the
API needs the Markdown report writer at runtime; all AZ-699 imports
re-pointed. OpenAPI spec exported to docs.

18/18 unit tests pass (AC-1 sync, AC-2 async, AC-3 state machine,
AC-5 auth, AC-6 health, AC-8 concurrency, AC-9 magic-byte). Full
unit suite: 2251 pass, 86 skip, 1 pre-existing C12 cold-start flake
(unchanged). mypy --strict clean on the new surface.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker/replay-api.Dockerfile

@@ -0,0 +1,47 @@
+# AZ-701 — operator-side replay HTTP API.
+#
+# Two-stage build. NOT bundled into the airborne companion-tier1
+# image (folium + FastAPI + uvicorn add ~30 MB and would regress
+# the airborne cold-start NFR). Build with:
+#
+#   docker build -f docker/replay-api.Dockerfile -t gps-denied-replay-api .
+#
+# Run with:
+#
+#   docker run --rm -p 8080:8080 \
+#       -e REPLAY_API_BEARER_TOKEN=secret \
+#       -v $(pwd)/data:/data \
+#       gps-denied-replay-api
+#
+# Health checks: /healthz (liveness) and /readyz (readiness).
+
+FROM ubuntu:22.04 AS python-deps
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        python3.10 \
+        python3.10-venv \
+        python3-pip \
+        libgl1 \
+        libglib2.0-0 \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /opt/gps-denied
+COPY pyproject.toml ./
+COPY src ./src
+RUN python3 -m venv /opt/venv \
+    && /opt/venv/bin/pip install --upgrade pip \
+    && /opt/venv/bin/pip install --no-cache-dir -e ".[operator-tools]"
+ENV PATH="/opt/venv/bin:${PATH}"
+
+FROM python-deps AS runtime
+ENV REPLAY_API_STORAGE_ROOT=/var/azaion/replay_api
+ENV REPLAY_API_HOST=0.0.0.0
+ENV REPLAY_API_PORT=8080
+RUN mkdir -p /var/azaion/replay_api
+EXPOSE 8080
+
+HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget -qO- http://127.0.0.1:8080/healthz || exit 1
+
+ENTRYPOINT ["replay-api"]