[AZ-777] Phase 1 hotfix (z/x/y) + Phase 2 Derkachi seed + ops

Phase 1 hotfix:
- C11 HttpTileDownloader adapted to satellite-provider v2.0.0
  z/x/y inventory contract (bulk POST keyed by slippy-map coords).
- Unit tests rewritten to exercise the new inventory schema.
- E2E smoke test updated to match the v2.0.0 wire.

Phase 2 (Derkachi seed + smoke-validated on Jetson):
- tests/fixtures/derkachi_c6/{README,bbox.yaml,seed_region.py}
  drives POST /api/satellite/region against satellite-provider
  with Google Maps as the imagery source. Smoke run produced
  4 regions, 175 tiles, inventory 32/32.
- scripts/mint_dev_jwt.py + run-tests-jetson.sh auto-mint and
  export SATELLITE_PROVIDER_API_KEY using JWT_SECRET / JWT_ISSUER
  / JWT_AUDIENCE env vars (no host port mappings; e2e-runner
  reaches SP via internal docker network only).

Spec amendment: AZ-777 todo spec updated to record the
Google Maps imagery source decision and STOP-gate state.

AZ-777 Phase 3+ work is superseded by Epic AZ-835 (see next
commit).

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/mint_dev_jwt.py

@@ -14,6 +14,7 @@ Usage::
 
     python scripts/mint_dev_jwt.py
     python scripts/mint_dev_jwt.py --lifetime-hours 12 --subject e2e-runner
+    python scripts/mint_dev_jwt.py --permission GPS   # unlocks /api/satellite/upload
     export SATELLITE_PROVIDER_API_KEY="$(python scripts/mint_dev_jwt.py)"
 """
 
@@ -85,6 +86,17 @@ def main() -> int:
         default=".env.test",
         help="Fallback env file (default: .env.test in CWD).",
     )
+    parser.add_argument(
+        "--permission",
+        action="append",
+        default=None,
+        metavar="NAME",
+        help=(
+            "Add a value to the `permissions` JWT claim. Repeatable "
+            "(e.g. --permission GPS --permission FL). Use `GPS` to unlock "
+            "/api/satellite/upload on the satellite-provider."
+        ),
+    )
     args = parser.parse_args()
 
     env_file_values = _load_env_file(Path(args.env_file))
@@ -127,6 +139,8 @@ def main() -> int:
         "nbf": int(now.timestamp()),
         "exp": int((now + timedelta(hours=args.lifetime_hours)).timestamp()),
     }
+    if args.permission:
+        payload["permissions"] = list(args.permission)
 
     token = jwt.encode(payload, secret, algorithm="HS256")
     sys.stdout.write(token + "\n")