[AZ-810] Strict validation for POST /api/satellite/upload metadata

Adds the per-endpoint child of AZ-795 ("Strict Input Validation Epic")
for the UAV upload multipart endpoint. Three new validators land under
SatelliteProvider.Api/Validators/:

- UavTileBatchMetadataPayloadValidator: items NotNull + NotEmpty +
  count <= MaxBatchSize + RuleForEach dispatching to the per-item
  validator.
- UavTileMetadataValidator: lat / lon / tileZoom range, tileSizeMeters
  > 0, capturedAt within [now - MaxAgeDays, now + future-skew]; uses an
  injectable TimeProvider so unit tests can drive a fixed clock.
- UavUploadValidationFilter: IEndpointFilter that reads the multipart
  `metadata` form field, deserializes it with the strict global
  JsonSerializerOptions (so UnmappedMemberHandling.Disallow +
  [JsonRequired] from AZ-795 are honored), runs the FluentValidation
  chain, and enforces the cross-field `items.Count == files.Count`
  envelope rule. FluentValidation errors are prefixed with `metadata.`
  so wire keys look like `errors["metadata.items[0].latitude"]`.

[JsonRequired] is added to every non-optional axis on
UavTileMetadata and UavTileBatchMetadataPayload; FlightId stays
nullable per AZ-503 anonymous-flight semantics.

Coverage: 13 unit tests + 16 integration tests + 1 curl probe script
exercise the happy path and every failure mode. All 9 ACs covered;
no regression in AZ-488 UavUploadTests payloads (traced against the
new rules).

Documentation: uav-tile-upload.md bumped v1.1.0 -> v1.2.0 with the
new validation rules section + 400-shape examples + changelog entry.
api_program.md updated to describe the three new validators + filter
+ the AddTransient<UavUploadValidationFilter>() DI registration.

Reports: batch_04_cycle8_report.md + reviews/batch_04_cycle8_review.md
record the PASS_WITH_WARNINGS verdict (2 Low DRY-in-tests findings:
FixedTimeProvider duplication crossed the cycle-2 "promote to shared"
threshold; PostBatch helper duplicated between two integration
suites). Both deferred to follow-up PBIs.

Task spec archived: _docs/02_tasks/todo/AZ-810... -> done/.
Jira: AZ-810 transitioned In Progress -> In Testing.

Co-authored-by: Cursor <cursoragent@cursor.com>

SatelliteProvider.Tests/Validators/UavTileBatchMetadataPayloadValidatorTests.cs

@@ -0,0 +1,103 @@
+using FluentValidation.TestHelper;
+using Microsoft.Extensions.Options;
+using SatelliteProvider.Api.Validators;
+using SatelliteProvider.Common.Configs;
+using SatelliteProvider.Common.DTO;
+
+namespace SatelliteProvider.Tests.Validators;
+
+// AZ-810: root metadata-envelope validator tests. Covers `items` non-null +
+// non-empty + cap rules. The per-item rules are covered by UavTileMetadataValidatorTests.
+public class UavTileBatchMetadataPayloadValidatorTests
+{
+    private readonly UavTileBatchMetadataPayloadValidator _validator;
+    private readonly DateTime _now;
+
+    public UavTileBatchMetadataPayloadValidatorTests()
+    {
+        GlobalValidatorConfig.ApplyOnce();
+        var config = Options.Create(new UavQualityConfig
+        {
+            MaxBatchSize = 100,
+            MaxAgeDays = 7,
+            CapturedAtFutureSkewSeconds = 30,
+        });
+        _now = new DateTime(2026, 5, 22, 12, 0, 0, DateTimeKind.Utc);
+        _validator = new UavTileBatchMetadataPayloadValidator(config, new FixedTimeProvider(_now));
+    }
+
+    private UavTileMetadata ValidItem() => new()
+    {
+        Latitude = 50.10,
+        Longitude = 36.10,
+        TileZoom = 18,
+        TileSizeMeters = 200.0,
+        CapturedAt = _now.AddMinutes(-5),
+        FlightId = null,
+    };
+
+    [Fact]
+    public void Validate_OneValidItem_Passes()
+    {
+        // Arrange
+        var payload = new UavTileBatchMetadataPayload { Items = new() { ValidItem() } };
+
+        // Act
+        var result = _validator.TestValidate(payload);
+
+        // Assert
+        result.ShouldNotHaveAnyValidationErrors();
+    }
+
+    [Fact]
+    public void Validate_ItemsEmpty_FailsNotEmptyRule()
+    {
+        // Arrange
+        var payload = new UavTileBatchMetadataPayload { Items = new() };
+
+        // Act
+        var result = _validator.TestValidate(payload);
+
+        // Assert
+        result.ShouldHaveValidationErrorFor("items")
+            .WithErrorMessage("`items` must contain at least one entry.");
+    }
+
+    [Fact]
+    public void Validate_ItemsTooMany_FailsCountRule()
+    {
+        // Arrange — 101 items (cap = 100)
+        var items = Enumerable.Range(0, 101).Select(_ => ValidItem()).ToList();
+        var payload = new UavTileBatchMetadataPayload { Items = items };
+
+        // Act
+        var result = _validator.TestValidate(payload);
+
+        // Assert
+        result.ShouldHaveValidationErrorFor("items")
+            .WithErrorMessage("`items` must contain at most 100 entries.");
+    }
+
+    [Fact]
+    public void Validate_PerItemFailure_PropagatesWithIndexedPath()
+    {
+        // Arrange — first item valid, second item lat out-of-range
+        var payload = new UavTileBatchMetadataPayload
+        {
+            Items = new() { ValidItem(), ValidItem() with { Latitude = 91.0 } },
+        };
+
+        // Act
+        var result = _validator.TestValidate(payload);
+
+        // Assert — error key follows the wire format produced by RuleForEach.
+        result.ShouldHaveValidationErrorFor("items[1].latitude");
+    }
+
+    private sealed class FixedTimeProvider : TimeProvider
+    {
+        private readonly DateTime _utcNow;
+        public FixedTimeProvider(DateTime utcNow) => _utcNow = utcNow;
+        public override DateTimeOffset GetUtcNow() => new(_utcNow, TimeSpan.Zero);
+    }
+}