[AZ-505] Tile inventory endpoint + HTTP/2 + Leaflet covering index

Production code:
- POST /api/satellite/tiles/inventory (XOR body, 5000-cap,
  most-recent-per-location_hash select, present/absent shaping).
- Kestrel HttpProtocols.Http1AndHttp2 on every listener (AC-5).
- Migration 015 creates tiles_leaflet_path covering index over
  (location_hash, captured_at DESC, updated_at DESC, id DESC)
  INCLUDE (file_path, source); drops superseded idx_tiles_location_hash.
- TileRepository.GetByTileCoordinatesAsync rewired to filter by
  location_hash (Index Only Scan via tiles_leaflet_path).
- TileRepository.GetTilesByLocationHashesAsync added with Npgsql-
  direct ANY($1::uuid[]) binding (Dapper IEnumerable expansion is
  incompatible with the array form).
- Uuidv5.LocationHashForTile centralises the UUIDv5(TileNamespace,
  "{z}/{x}/{y}") formula — single source of truth for the cross-repo
  invariant (gps-denied-onboard parity).

Contracts:
- New: contracts/api/tile-inventory.md v1.0.0.
- Bumped: contracts/data-access/tile-storage.md to v2.0.0 (joint
  ownership by AZ-503-foundation + AZ-505: schema + covering index +
  GetByTileCoordinatesAsync rewrite).

Tests:
- TileInventoryTests covers AC-1, AC-2 (DB-level), AC-4, AC-6.
- Http2MultiplexingTests covers AC-5 (20 concurrent multiplexed GETs
  over h2c via SocketsHttpHandler + AppContext Http2Unencrypted switch).
- LeafletPathIndexOnlyTests covers AC-3 (EXPLAIN (ANALYZE, BUFFERS)
  asserts Index Only Scan over tiles_leaflet_path with heap_blocks=0).

Docs:
- architecture.md, system-flows.md, data_model.md, module-layout.md,
  glossary.md, modules/api_program.md, modules/dataaccess_tile_repository.md,
  components/02_data_access/description.md all updated to reference the
  v2.0.0 tile-storage contract + new tile-inventory contract + AC-7.

Reports:
- batch_01_cycle6_report.md, batch_01_cycle6_review.md,
  implementation_completeness_cycle6_report.md (PASS),
  implementation_report_tile_inventory_cycle6.md.

Task spec moved todo/ -> done/.

Co-authored-by: Cursor <cursoragent@cursor.com>

SatelliteProvider.Common/DTO/TileInventory.cs

@@ -0,0 +1,66 @@
+namespace SatelliteProvider.Common.DTO;
+
+// AZ-505: bulk-list / inventory request envelope. Either `Tiles` OR
+// `LocationHashes` is populated — never both, never neither. The handler
+// converts every `(z, x, y)` coord into a `location_hash` via UUIDv5 and
+// queries `tiles_leaflet_path` once. Response order matches request order.
+//
+// Max entries per request: see TileInventoryLimits.MaxEntriesPerRequest.
+public sealed class TileInventoryRequest
+{
+    public IReadOnlyList<TileCoord>? Tiles { get; set; }
+    public IReadOnlyList<Guid>? LocationHashes { get; set; }
+}
+
+// AZ-505: Slippy-map tile coordinate triple. Field naming matches the on-wire
+// snake_case used by the existing `GET /tiles/{z}/{x}/{y}` and the AZ-484/AZ-503
+// `tiles` table columns (`tile_zoom`, `tile_x`, `tile_y`).
+public sealed class TileCoord
+{
+    public int TileZoom { get; set; }
+    public int TileX { get; set; }
+    public int TileY { get; set; }
+}
+
+// AZ-505: Inventory response. Entries are returned in the SAME ORDER as the
+// matching request input (per AC-1). When Request.Tiles was populated, each
+// entry's `TileZoom`/`TileX`/`TileY` echoes the request entry; when
+// Request.LocationHashes was populated, the coord triple fields are 0 (the
+// caller already knows the hash and can map it back themselves).
+public sealed class TileInventoryResponse
+{
+    public IReadOnlyList<TileInventoryEntry> Results { get; set; } = Array.Empty<TileInventoryEntry>();
+}
+
+// AZ-505: One entry per request input. `Present` indicates whether a row
+// exists in the `tiles` table for the resolved `LocationHash`. When
+// `Present == false` only `LocationHash` (and the echoed coord triple, if the
+// request used coords) is populated — the rest are null.
+//
+// `EstimatedBytes` is intentionally absent in v1.0.0 — adding the per-row
+// `stat()` cost is deferred until production profiling justifies it (see
+// AZ-505 Outcome bullet 1 + Excluded list).
+public sealed class TileInventoryEntry
+{
+    public int TileZoom { get; set; }
+    public int TileX { get; set; }
+    public int TileY { get; set; }
+    public Guid LocationHash { get; set; }
+    public bool Present { get; set; }
+
+    public Guid? Id { get; set; }
+    public DateTime? CapturedAt { get; set; }
+    public string? Source { get; set; }
+    public Guid? FlightId { get; set; }
+    public double? ResolutionMPerPx { get; set; }
+}
+
+// AZ-505: per-task constants exposed for the request validator + tests.
+// Living under DTO so both the API handler and test assertions can reference
+// the same value without re-deriving it.
+public static class TileInventoryLimits
+{
+    // 2x headroom over the AC-4 perf gate of 2500 tiles. Anything larger is
+    // rejected with HTTP 400 by the API handler.
+    public const int MaxEntriesPerRequest = 5000;
+}

SatelliteProvider.Common/Interfaces/ITileService.cs

@@ -9,5 +9,11 @@ public interface ITileService
     Task<IEnumerable<TileMetadata>> GetTilesByRegionAsync(double latitude, double longitude, double sizeMeters, int zoomLevel);
     Task<TileBytes> GetOrDownloadTileAsync(int z, int x, int y, CancellationToken cancellationToken = default);
     Task<TileMetadata> DownloadAndStoreSingleTileAsync(double latitude, double longitude, int zoomLevel, CancellationToken cancellationToken = default);
+    // AZ-505: bulk-list / inventory endpoint. Maps every request entry to its
+    // location_hash, queries the repository in one round-trip, and returns one
+    // response entry per request entry — in the same order. Callers are
+    // expected to validate the request shape (`Tiles` XOR `LocationHashes`,
+    // entry count cap) BEFORE invoking this method.
+    Task<TileInventoryResponse> GetInventoryAsync(TileInventoryRequest request, CancellationToken cancellationToken = default);
 }
 

SatelliteProvider.Common/Utils/Uuidv5.cs

@@ -1,4 +1,5 @@
 using System.Buffers.Binary;
+using System.Globalization;
 using System.Security.Cryptography;
 using System.Text;
 
@@ -23,6 +24,19 @@ public static class Uuidv5
     // 128-bit constant shared between the two repos).
     public static readonly Guid TileNamespace = new("5b8d0c2e-7f1a-4d3b-9c5e-1f3a8e7d2b6c");
 
+    // AZ-505 consolidation: the canonical formula for a tile cell's
+    // location_hash. Both TileRepository.GetByTileCoordinatesAsync and
+    // TileService.GetInventoryAsync compute it; centralising here means the
+    // cross-repo invariant (must byte-match gps-denied-onboard
+    // `c6_tile_cache/_uuid.py:location_hash`) only has one source-of-truth in
+    // this codebase. Format string is `"{z}/{x}/{y}"` under invariant culture —
+    // matches the Python side's f-string output.
+    public static Guid LocationHashForTile(int tileZoom, int tileX, int tileY)
+    {
+        var name = string.Create(CultureInfo.InvariantCulture, $"{tileZoom}/{tileX}/{tileY}");
+        return Create(TileNamespace, name);
+    }
+
     public static Guid Create(Guid namespaceId, string name)
     {
         ArgumentNullException.ThrowIfNull(name);