[AZ-777] Phase 1: wire e2e-runner to real satellite-provider + C11 contract adapt

Adapt C11 HttpTileDownloader to the AZ-505 v1.0.0 tile-inventory
contract (POST /api/satellite/tiles/inventory + GET /tiles/{z}/{x}/{y})
and wire the Jetson e2e harness against the real parent-suite
satellite-provider service. Closes Phase 1 of 5 for AZ-777; STOP
gate before Phase 2 (Derkachi catalog seed).

C11 changes:
- _LIST_PATH / _GET_PATH replaced with _INVENTORY_PATH + _TILES_PATH.
- _do_enumerate enumerates bbox tile coords client-side and posts
  chunked inventory requests (5000-entry cap per the contract).
- _download_one_tile parses tile_id_str into (z,x,y) and fetches
  the slippy-map URL.
- Common GET / POST retry+auth ladder consolidated into _send_request.
- New module helpers: _enumerate_bbox_tile_coords,
  _tile_center_latlon, _tile_size_meters_at, _format_tile_id_str,
  _parse_tile_id_str, _chunk_iter.
- _DEFAULT_ESTIMATED_TILE_BYTES (50 KiB) replaces the inventory-side
  estimatedBytes field the v1.0.0 contract dropped.

Tests:
- 14/14 unit tests in tests/unit/c11_tile_manager/test_tile_downloader.py
  rewritten for the new POST inventory + slippy-map GET handler.
  _StubTileWriter rekeyed by call-index (the downloader now derives
  lat/lon from the slippy-map coord, so fixtures can't fabricate
  arbitrary positions).
- New Tier-2 smoke at tests/e2e/satellite_provider/test_smoke.py:
  validates inventory POST schema + drives HttpTileDownloader against
  the real service. Gated by RUN_REPLAY_E2E=1 + tier2.

Compose / env:
- e2e-runner SATELLITE_PROVIDER_URL switched from mock-sat:5100 to
  https://satellite-provider:8080; TLS_INSECURE + Bearer JWT env +
  depends_on satellite-provider added.
- .env.test.example documents SATELLITE_PROVIDER_API_KEY + dev TLS
  bypass security note.
- scripts/mint_dev_jwt.py mints HS256 dev JWTs from env / .env.test.
- pyjwt added to dev extras.

Tracker hygiene:
- AZ-777 row in _dependencies_table.md bumped 5pt -> 8pt to match
  the 2026-05-21 override decision log.

Code review: PASS_WITH_WARNINGS (3 medium/low findings, all deferred
to later AZ-777 phases) -- see batch_104_review.md. Batch report at
batch_104_cycle3_report.md.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.test.jetson.yml

@@ -118,6 +118,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+      satellite-provider:
+        condition: service_healthy
     environment:
       # Same FullSystemConfig env block as Colima — see comments in
       # docker-compose.test.yml for the per-var rationale.
@@ -127,10 +129,21 @@ services:
       # execute. This is the WHOLE POINT of the Jetson harness.
       GPS_DENIED_TIER: "2"
       DB_URL: postgresql://gps_denied:dev@db:5432/gps_denied
-      # SATELLITE_PROVIDER_URL / COMPANION_URL are set but not used by
-      # the replay CLI tests (gps-denied-replay runs as a subprocess and
-      # does not call the companion or satellite-provider HTTP APIs).
-      SATELLITE_PROVIDER_URL: http://mock-sat:5100
+      # AZ-777 Phase 1: e2e-runner consumes the real parent-suite
+      # satellite-provider .NET service over its compose-DNS name. The
+      # dev TLS cert is self-signed against `localhost`, so the suite-
+      # internal probe must skip cert verification — see SECURITY note
+      # in `.env.test.example`. Production deploys ship a real CA-issued
+      # cert and MUST set SATELLITE_PROVIDER_TLS_INSECURE="0" (or omit it).
+      SATELLITE_PROVIDER_URL: https://satellite-provider:8080
+      SATELLITE_PROVIDER_TLS_INSECURE: "1"
+      SATELLITE_PROVIDER_API_KEY: ${SATELLITE_PROVIDER_API_KEY:?SATELLITE_PROVIDER_API_KEY must be set via .env.test — see scripts/mint_dev_jwt.py}
+      # AZ-777 Phase 1 also forwards the JWT triple so the smoke test
+      # can mint its own dev token in-container as a fallback when
+      # SATELLITE_PROVIDER_API_KEY is rotated mid-session.
+      JWT_SECRET: ${JWT_SECRET}
+      JWT_ISSUER: ${JWT_ISSUER}
+      JWT_AUDIENCE: ${JWT_AUDIENCE}
       COMPANION_URL: http://companion:8080
       CAMERA_CALIBRATION_PATH: /opt/tests/fixtures/calibration/adti26.json
       LOG_LEVEL: INFO