[AZ-701] HTTP replay API service (FastAPI + magic-byte upload validation)

New replay_api component: FastAPI service wrapping the offline
gps-denied-replay pipeline. POST tlog+video (multipart) → either
sync 200 with result/map/report URLs, or async 202 + job id with
/jobs/{id} polling. Magic-byte validation, bearer auth, in-memory
JobRegistry with concurrency + queue caps (429 on overflow).

Helper accuracy_report.py promoted from tests/ to src/ because the
API needs the Markdown report writer at runtime; all AZ-699 imports
re-pointed. OpenAPI spec exported to docs.

18/18 unit tests pass (AC-1 sync, AC-2 async, AC-3 state machine,
AC-5 auth, AC-6 health, AC-8 concurrency, AC-9 magic-byte). Full
unit suite: 2251 pass, 86 skip, 1 pre-existing C12 cold-start flake
(unchanged). mypy --strict clean on the new surface.

Co-authored-by: Cursor <cursoragent@cursor.com>

e2e/docker/docker-compose.test.yml

@@ -63,6 +63,37 @@ services:
       interval: 5s
       retries: 12
 
+  # AZ-701 — operator-side replay HTTP API.
+  #
+  # Profile-gated so the default `docker compose up` flow (the
+  # blackbox e2e suite) is unaffected. To start the API alongside
+  # the suite, run:
+  #     docker compose --profile replay-api up replay-api
+  # The container exposes /healthz on 8080 and refuses /replay
+  # uploads without a bearer token unless REPLAY_API_AUTH_REQUIRED
+  # is explicitly set to false (dev only — WARN logged).
+  replay-api:
+    profiles: ["replay-api"]
+    build:
+      context: ../..
+      dockerfile: docker/replay-api.Dockerfile
+    image: gps-denied-replay-api:e2e
+    networks: [e2e-net]
+    ports:
+      - "${REPLAY_API_HOST_PORT:-8080}:8080"
+    environment:
+      REPLAY_API_AUTH_REQUIRED: "${REPLAY_API_AUTH_REQUIRED:-true}"
+      REPLAY_API_BEARER_TOKEN: "${REPLAY_API_BEARER_TOKEN:-}"
+      REPLAY_API_MAX_CONCURRENT_JOBS: "${REPLAY_API_MAX_CONCURRENT_JOBS:-1}"
+      REPLAY_API_MAX_QUEUED_JOBS: "${REPLAY_API_MAX_QUEUED_JOBS:-8}"
+      REPLAY_API_STORAGE_ROOT: /var/azaion/replay_api
+    volumes:
+      - replay-api-storage:/var/azaion/replay_api
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
+      interval: 10s
+      retries: 5
+
   mavproxy-listener:
     image: ardupilot/mavproxy:latest
     networks: [e2e-net]
@@ -135,6 +166,7 @@ volumes:
   tile-cache-fixture: {}
   tlog-output: {}
   mock-audit: {}
+  replay-api-storage: {}
   e2e-results:
     driver: local
     driver_opts: