[AZ-310] [AZ-311] Route tile endpoints through ITileService

Move cache+DB+download logic for /tiles/{z}/{x}/{y} and
/api/satellite/tiles/latlon out of Program.cs into TileService.
Endpoints now inject only ITileService + ILogger. Service owns
IMemoryCache (1h absolute / 30min sliding preserved). Added
TileBytes DTO; ITileService gains GetOrDownloadTileAsync and
DownloadAndStoreSingleTileAsync. 5 new unit tests cover cache
hit, repo hit, downloader fallback, and AZ-311 happy + error.

Build clean (0/0), unit suite 40/40. Resolves architecture
baseline F3 in code (docs handled by AZ-315).

Co-authored-by: Cursor <cursoragent@cursor.com>

SatelliteProvider.Tests/InfrastructureTests.cs

@@ -1,4 +1,5 @@
 using FluentAssertions;
+using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging.Abstractions;
 using Moq;
 using SatelliteProvider.Common.DTO;
@@ -60,10 +61,11 @@ public class InfrastructureTests
         // Arrange
         var downloader = new Mock<ISatelliteDownloader>().Object;
         var tileRepo = new Mock<ITileRepository>().Object;
+        var cache = new MemoryCache(new MemoryCacheOptions());
         var logger = NullLogger<TileService>.Instance;
 
         // Act
-        var service = new TileService(downloader, tileRepo, logger);
+        var service = new TileService(downloader, tileRepo, cache, logger);
 
         // Assert
         service.Should().NotBeNull();